[courier-users] CISCO PIX 5xx cause EHLO not functining and result in a 513 relay denied error

[han]

One of my roaming users complains he can’t send mail from temporary work site(in an other city), he got a “513 relay denied” error. I checked /var/log/maillog, there are his errors:   Mar  9 13:48:59 newgateway courieresmtpd: started,ip=[::ffff:211.151.91.35] Mar  9 13:48:59 newgateway courieresmtpd: XXXX sitepc Mar  9 13:48:59 newgateway courieresmtpd: error,relay=::ffff:211.151.91.35,msg="502 ESMTP command error",cmd: XXXX sitepc   I let him tried with telnet to the 25 port of my mail server; here is the result he sent back: . Connected to smtp.mycompany.com. Escape character is '^]'. ehlo sitepc 220 ****************************   As far as I know, CISCO PIX 5xx has a maiguard command:   fixup protocol smtp 25   it will cause this error >:-<    in fact, cisco PIX 5xx rewrite EHLO command as XXXX, so courier server got confused and return a error, since mail client software received an error after send EHLO, it will think that this server doesn’t need smtp authentication, and send these two commands: MAIL FROM: <xxxx> , RCPT TO: <xxxx> , then courier server will respond with a 513 relay denied error casue this client not being authenticated yet .     but how can I persuade an administrator of an other city’s ISP to add one line “no fixup protocol smtp 25” there??   I heard that some other MTA like qmail can avoid ehlo command by force client do a pop3 before smtp, if pop3 passed, this client will be allowed to do a smtp, can courier do the same trick? How to set it up? Or there is any other solution? Thanks in advance!! I don’t want to change my MTA only because courier have to stick with ehlo command…