Common "feature". Cisco devices by default allow only SMTP, not ESMTP. These defaults keep coming back to bite admins, year after year after year.
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113423-asa-esmtp-smtp-inspection.html provides one example of how to switch off their policy, you need to check for the product that you're actually using. -jim Excerpts from Todd Herr's message of 2016-05-06 12:08:40 +1200: > Forgive me if this is off topic, but I don't know where else to turn. > > I've got a customer who's having trouble sending mail to two domains with > nothing obvious (to me) in common save for one thing; both domain's primary > MXen look to be sitting behind Cisco PIX devices with Mailguard turned on. > I know this because of the greeting I get from both: > > 220 ******************************************************************* > > Now, everything I can find about these devices says that they only allow > seven SMTP commands: > > HELO, > MAIL > , > RCPT > , > DATA > , > RSET > , > NOOP > , > QUIT > > > > And they're supposed to respond with OK to everything else. These two > domains, again not obviously related, mail servers in different /8s, don't > even do that, though; both of them are responding in > unsuspected ways even to commands from the above list, to wit: > > RSET > 500 Syntax error, command unrecognized > QUIT > 500 Syntax error, command unrecognized > > > I've never wrangled one of these beasts (haven't even *seen* evidence of > one in many years) so I'd like to ask you fine folks if you've ever seen > anything like this from one of these, and what it means for their > configuration? I mean, is this a common bug/misconfiguration, or have I > just hit the lottery? > > Thanks. > -- Jim Cheetham, Information Security, University of Otago, Dunedin, N.Z. ✉ [email protected] ☏ +64 3 470 4670 ☏ m +64 21 279 4670 ⚷ OpenPGP: B50F BE3B D49B 3A8A 9CC3 8966 9374 82CD C982 0605
signature.asc
Description: PGP signature
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
