????? ?? Cisco PIX ?? Cisco ASA ???????? ?? ???? ?-??? ????? ??????? ???? ?? ????

?? ?? ?? ???? ????? ??????? ?? ????? ?? ???? ??:

• ?? ???????-?????? ?-??? ????? ??????? ???? ?? ???? ???
• ?? ?-??? ???????? ?? ??? ????? ???? ??? ?????
• ?? Microsoft Exchange ?? ??? ?? ?????? ???? ??????? ???? ?? ???? ????? ????? 25 ???
• ?? ?? ????? ??? ??EHLO???? Exchange ????? ?? ??? ???? ?? "???? ? ?????? ???" ?? "???" ?? ??? ???????? ????????
• ?? ??????? ????? ?? ??? ??????? ?? ??? ???? ?? ?????
• ????? Office ????????? ??????? 3 (POP3) ?? ??? ?????? ??????? - ??????? ????? ?? ????? relaying 550 5.7.1?
• ????????? ?-??? ????? ???? ???? (???-??? ???? ?? ?? ???) ?? ??? ?????? ???
• ???? ????????? ??? ?????? ??? ?????????? ????????? (SMTP) ????? ??????? ???? ???
• Microsoft Outlook ??????? ?? Microsoft Outlook Express ??????? ??? 0x800CCC79 ?????? ??????? ?? ?-??? ????? ?? ?????? ?? ??? ???
• ?????? mime (8bitmime) ??? ???????? ???? ???? ?? ???-??????? ??????? (NDR) ??? ????? ??? ????? ??:
  554 5.6.1 ????? ?????? ?????? ????? ?????? ??????? ?????
• ????? ?? ???????? ???????? ??? ???????? ????
• ???? ?????? ?????? Cisco PIX ?? Cisco ASA ???????? ?????? ?????? ?????? ?? ??? ?? ?? ?????? ?????? ?? ??? ?? ??? ???????? ????
• X-LINK2STATE ?????? ??? ???? ???
• ??? ?????? ???? ??????? ?? ????? ?? ??? ??????? ???????? ????

?? ?????? ????? ?????? ??? ?? ???? ??:

• Exchange ????? ?? Cisco PIX ?? Cisco ASA ???????? ?????? ?? ???? ????? ???
  
  -??-
• PIX ?? ASA ??????? ?? Mailguard ?????? ???? ???
• ??????????? ?? ??????????? ????? ???? ???????? ?? ?????? (????????? ?????? ??? ?????????? ????????? [ESMTP] ????) stripped ???, ?? ?? ????? ?? ?? ?? ???-??????? ????? ?? relaying ??? ?????? ????? ???

????????? ???? ?? ???? ???? Cisco PIX ?? Cisco ASA ???????, MX ??????? ?? IP ??? ???? ?? ??? ?????? ?? Mailguard ?? ??? ?? ?? ???? ??? ?????? ?? ???? ??????????? ????? ?? ???? ????? ??:???? ??????? ?? ???, ????? Cisco ??? ?????? ?? ????:???:??? ???? ??? PIX ?? ASA ?? ???? ??? ESMTP ????? ???????, ?? ???? ?? ???? ??? ??? ????? ?? flow ???? ?? ??? ?????? ???? ?? ??? Mailguard ?????? ?? ??? ????? ??? ??, 25 ????? ?? ??? ??? ?????? ???? ??????? ???? ?? ??? ?? ???? ?? ??? ????fixup ????????? smtp????, ????? ??? ?? ???? ??? ?? ????? ???? ?? ?? ?????? ??????? ?? ????

???:Cisco PIX ?? Cisco ASA ???????, besides ???? ?? ???? ?? ?? ???? ?? ???? ??? ???????? ???????? ?????? SMTP ???????? ???????? ??? ?? ?? ???????? ?????? ???? ?????? ????? ??? SMTP ???????? ???????? ???????? ?????????? ?? ???? ????? ??:

• Watchguard Firebox
• ????????
• Raptor

???????? ??????? ?? ??? "???? ???????" ??? ??? ???????? ??? ???? ?? ?????

???????:?? ?????? ?????????????? ???????????? ?? ?????????????? ?????????? ???? ????? attack ???? ?? ??? ??? ???????? ?? ???? ??????? ????? ???? ????????? ??? ?? ???? ??? ?? ?? ???? ?????? ?? ??????? ???? ???? ??? ????? ?? ??????? ?????? ?? ??? ??? ???? ?? ???? ????? ?? ????? ??? ?? ???? ?????? ?? ??????????? ?? ????.. ?? ???? ?????? ?? ???? ????? ?? ????? ?? ????? ????..

???:??? ???????? ???? ???????? ?? ?????????????? ???????????? ?? ?????????????? ?????????? ???? ????? ??????? ??? ???????? ??????? ?? ????? ?? ???? ???????? ?? attack ????? ?? ????? ??? ??? ???? ?? ??? ??????? ???? ??? ??? ???? ???? ?? ?? ???? ??????? ????? ????, ???? ???? ???????? ?? ??? ???????, ??????? ???? ?????????? ???? ???????

?? ?????? ?? ?? ???? ?? ??? Mailguard ?????? ??? ?? PIX ?? ASA ?????????

???????:If you have an ESMTP server behind the PIX or ASA, you may have to turn off the Mailguard feature to make it possible for mail to correctly flow. If you use the Telnet command to port 25, this may not work with thefixup protocol smtpcommand, and this is more noticeable with a Telnet client that performs character mode.

To turn off the Mailguard feature of the PIX or ASA firewall:

1. Log on to the PIX or ASA firewall by establishing a telnet session or by using the console.
2. ??????:enable, and then press ENTER.
3. When you are prompted for your password, type your password, and then press ENTER.
4. ??????:configure terminal, and then press ENTER.
5. ??????:no fixup protocol smtp 25, and then press ENTER.
6. ??????:write memory, and then press ENTER.
7. Restart or reload the PIX or ASA firewall.

The PIX or ASA Software Mailguard feature (also called Mailhost in early versions) filters Simple Mail Transfer Protocol (SMTP) traffic. For PIX or ASA Software versions 4.0 and 4.1, themailhostcommand is used to configure Mailguard. In PIX or ASA Software version 4.2 and later, thefixup protocol smtp 25command is used.

???:You must also have static IP address assignments and conduit statements for your mail server.

When Mailguard is configured, Mailguard allows only the seven SMTP minimum-required commands as described in request for comment (RFC) 821, section 4.5.1. These seven required commands are the following:Other commands, such as KILL and WIZ are not forwarded to the mail server by the PIX or ASA firewall. Early versions of the PIX or ASA firewall return an "OK" response, even to commands that are blocked. This is intended to prevent an attacker from the knowledge that the commands have been blocked.

To view RFC 821, visit the following RFC Web site:All other commands are rejected with the "500 Command unrecognized" response.

On Cisco PIX and ASA firewalls with firmware versions 5.1 and later, thefixup protocol smtpcommand changes the characters in the SMTP banner to asterisks except for the "2", "0", "0 " characters. Carriage return (CR) and linefeed (LF) characters are ignored. In version 4.4, all characters in the SMTP banner are converted to asterisks.

Test Mailguard for proper function

Because the Mailguard feature may return an "OK" response to all commands, it may be hard to determine whether it is active. To determine whether the Mailguard feature is blocking commands that are not valid, follow these steps.

???:The following steps are based on PIX or ASA software version 4.0 and 4.1. To test later versions of PIX or ASA software (version 4.2 and later), use thefixup protocol smtp 25command and the appropriatestatic, ??conduitstatements for your mail server.

With Mailguard turned off

1. On the PIX or ASA firewall, use the static and conduit commands to allow all hosts in on TCP port 25 (SMPT).
2. Establish a telnet session on the external interface of the PIX or ASA firewall on port 25.
3. Type a command that is not valid, and then press ENTER. For example, typegoodmorning, and then press ENTER.
   
   You receive the following response:
   500 Command unrecognized.

With Mailguard turned on

1. ?????mailhostor thefixup protocol smtp 25command to turn on the Mailguard feature on the external interface of the PIX or ASA firewall.
2. Establish a telnet session on the external interface of the PIX or ASA firewall on port 25.
3. Type a command that is not valid, and then press ENTER. For example, typegoodmorning, and then press ENTER.
   
   You receive the following response:
   OK.

?? Mailguard ?????? ??? ?? ???? ??, ??? ????? ?? ???? ?? ??? ??????? "500 ???? ? ?????? ???" ????? ?? ??? ????? ???? ??? ???????, ?? Mailguard ?????? ???? ??, PIX ?? ASA ???????? intercepts ???? ????? ???? ??, ??????? ???????? passes ???? ??? ??????? ???????? SMTP ????? PIX ?? ASA ???????? ?? "???" ?? ??? ???? ???? ?? ???? ????? ???

???????? ??? ??, PIX ?? ASA ??????? ??? ???? ??????? ?? ???? ?? ??????? ?? ???????? ????? ????? ????? ????? ?? ?????? ???? ?? ??? ???????, ????? ????, ?? ????? ???? ???? ??? ?? ????? ????? ?? ????????? ?? ???? ??? ???????? ??????? ?? ??? ????? Cisco ??? ???? ?? ????:Cisco PIX ?? ASA ??????? ?? ???????? ???? ???? ?? ???? ??? ???????? ??????? ?? ??? ????? ????? Cisco ??? ?????? ?? ????:

SMTP ???????? ???????? ?? ??? ?? ???????? ???????? ?? ???? ??? ???? ??????? ?? ??? ????? ??? ?????? ?? ????:?? ?????-???? ?????? Microsoft ?? ???????? ???????? ?????? ??????? ??? ?? ??? ????? ?? ???? ????? ???? ??.. Microsoft ?? ???????? ?? ???????? ?? ??????????? ?? ???? ??? ??? ?????? ???? ???? ??, ????? ?? ??????..?????? ?????? ???? ??? ???? ?????? ???? ?? ??? Microsoft ???? ?????-???? ?????? ??????? ?????? ????? ??.. ?? ?????? ??????? ???? ???? ????? ????? ?? ??? ???? ??.. Microsoft ?? ?????-???? ?????? ??????? ?? ??? ???? ?? ??? ?????? ???? ????..