3

On an ASA I administer there is a policy-map in place which implements "inspect ESMTP". I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing to implement. It is however impacting the ability to send mass emails from lists with over 50 recipients according to our domain admins. They want to remove this inspection to alleviate the problem.

Is ESMTP inspection a solid control to leave and place, or is removal safe? If I don't want to remove it, is there a way to see what in the control is preventing mail from being sent and possibly alter that one element of it rather than removing it altogether?

  • Hi and thank you for your question. As phrased, it's too broad ("any in field experience"). FYI, I will also share a link to my unpleasant ASA SMTP inspection experience, which led me to leave it disabled. May I edit out the last sentence of your question? – Mike Pennington Jan 29 '14 at 18:25
  • Yeah absolutely, ty! Checking out your articles now. – A L Jan 29 '14 at 18:32
  • Hah, you know what almost same situation with us. Never had problems on an older 8.2/3 ASA5510, but we recently upgraded to a 5515 on 9.1 and it started doing the same XXXXX bit. – A L Jan 29 '14 at 18:34
3

It only looks harmless. :-) In reality, Cisco has a long history of botching the STMP and ESMTP inspection. And honestly, it won't provide any protection from current evolving threats; it doesn't use a dynamic set of rules that can be updated regularly. Email filtering and inspection is best done by a dedicated appliance that's up-to-date.

To my knowledge, there are no knobs on inspect esmtp. And this is enough of a reason to never turn it on:

For example, Telnet sends each character individually in a different packet on the wire, but actual email clients and servers send the entire command in one packet. If you use Telnet and you type H, the Telnet client sends an H to the email server. Since ESMTP and SMTP inspection do not recognize H as a valid command, the ASA replaces the H with an X and passes it along.

| improve this answer | |
  • Very cool, glad for all the feedback on this! I've got a change scheduled to disable this :). – A L Jan 30 '14 at 15:18
4

You can change the paramters of what ESMTP inspection does by creating a custom policy map. For example, say you wanted to do disable the banner masking and also log rather than deny lines greater than 998 characters:

policy-map type inspect esmtp custom_esmtp_map
 parameters
   no mask-banner
 match header line length gt 998 
  log
 match body line length gt 998 
  log
!
policy-map global_policy
 class inspection_default
  no inspect esmtp
  inspect esmtp custom_esmtp_map 
!
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.