1

having an ASA 5510 (8.3(2)).

2 Interfaces: 1. NGCC, SecurityLevel 20, one Host with IP 1.2.3.4 Microsoft ESMTP MAIL Service, Version: 8.5.9600.16384 on Port 25 2. DMZ, Security Level 20, one Host with IP 5.6.7.8 Postfix 2.6.6 on Port 25

ESMTP Inspection is enabled (global_policy/inspection_default)

Trying to connect from a Network with Security Level 50 using telnet 5.6.7.8 25 shows me the SMTP Banner and i can use e.g. EHLO/HELO without problems.

telnet 1.2.3.4 25 gives me the 220 **** Banner and only 500 5.3.3 Replies regardless of the command i send. Until i disable ESMTP Inspection, then telnet 1.2.3.4 25 works fine.

The Network i'm connecting from does not have any ACLs or NAT Rules between the one or the other destination network.

What am i missing ? Why is this working on one Interface but not on the other ?

thanks

3
  • 1
    Heed the internet's collective wisdom: turn that broken crap off. I've never seen it work right, and it interferes with everything. – Ricky Sep 3 '15 at 7:42
  • Thanks, i already did that. I was just curious why one interface is working and the other one not. Same config except for the IP – unficyp Sep 3 '15 at 9:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 5:30
1

Everything being done by the ESMTP inspection is related to the information being exchanged between hosts. It is not related to NAT, ACLs, IPs or interfaces the client and server reside on with one exception: One of the interfaces the traffic is traversing has the inspection rule turned on or it is globally turned on for all interfaces.

The information being sent between hosts will be modified if it doesn't match the criteria the ASA expects or if it sends information the ASA wants to mask between parties.

More info can be found in the config guide.

Reason for 220 Banner Modification

Another security feature used by these devices is SMTP banner modification. In order to hide the type and version of the protected mail server, some devices will obscure all but the 220 portion of the banner that is required for communication. The banner will often appear similar to: 220*************

Part of the information being hidden is the ESMTP advertisement in the banner. When this advertisement is removed, a sending server will not be aware that ESMTP commands are accepted.

Source

You can also disable just the banner modification.

policy-map type inspect esmtp new_estmp_inspect_map
  parameters
    no mask-banner

policy-map global-policy
  class class-default
    inspect esmtp new_esmtp_inspect_map
service-policy global-policy global

Source.

Reason for Replies

The ASA only supports 15 SMTP commands, any others will return the errors you are seeing. The second SMTP server (1.2.3.4) is using commands the ASA doesn't support or they are improperly formatted.

ESMTP application inspection adds support for extended SMTP commands, including AUTH, EHLO, ETRN, HELP, SAML, SEND, SOML, STARTTLS, and VRFY. Along with the support for seven RFC 821 commands (DATA, HELO, MAIL, NOOP, QUIT, RCPT, and RSET), the ASA supports a total of 15 SMTP commands. Other extended SMTP commands, such as ATRN, ONEX, VERB, and CHUNKING, and private extensions are not supported. Unsupported commands are translated into Xs, which are rejected by the internal server. This results in a message such as "500 Command unknown: 'XXX'." Incomplete commands are discarded.

Source

To verify, I recommend using a packet sniffer between the ASA and 1.2.3.4 to see which commands are being returned.

3
  • Thanks, i found this in the docs already but that doesn't explain why i see 220 ****** right after a telnet to 1.2.3.4. i didnt send a single command. I dont understand where the difference between 1.2.3.4 and 5.6.7.8 (or the interfaces between) is except that the one is MS and the other one is postfix. the only thing that comes into my mind: Is it possible that the ASA checks the Hostname / IP ? 1.2.3.4 is internal without any DNS entry, 5.6.7.8 has valid DNS records. – unficyp Sep 4 '15 at 10:51
  • Updated to explain the banner modification. – Chris Balmer Sep 4 '15 at 11:15
  • I also added a bit explaining why it modifies traffic in general. – Chris Balmer Sep 4 '15 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.