onnected through an ASA to a mail server using Telnet. This ASA is not running the SMTP fixup, which you should rarely see in the wild, as it is enabled by default. When I issue the SMTP com- mand EHLO someserver, I get a list of information regarding the capabilities of the mail server: Inspects [GAD@someserver GAD]$telnet mail.myserver.net 25 Trying 10.10.10.10 Connected to mail.myserver.net Escape character is '^]'. 220 mail.myserver.net ESMTP Postfix EHLO someserver 250-mail.myserver.net 250-PIPELINING 250-SIZE 10240000 250-ETRN 250 8BITMIME This information is not necessary for the successful transfer of email messages, and could be useful to a hacker. For example, a hacker could try to pull email messages off the server using the ETRN deque command. The SMTP inspect intercepts and disables the ETRN command. ETRN is a very useful feature of SMTP that allows ISPs to queue mail for you should your email server become unavailable. If you need to use ETRN, you will have to disable the SMTP inspect on your firewall. ASAs have most of the commonly used inspects enabled by default. Here, I'll enable the SMTP inspection, though normally you would not need to do this: ASA-5540/GAD(config)# policy-map global_policy ASA-5540/GAD(config-pmap)# class inspection_default ASA-5540/GAD(config-pmap-c): inspect esmtp Now the ASA will intercept and manage every SMTP request: [GAD@someserver GAD]$telnet mail.myserver.net 25 Trying 10.10.10.10 Connected to mail. .myserver.net Escape character is '^]'. EHLO someserver 502 Error: command not implemented Look at the items in bold and compare the output to the previous example. Without the SMTP inspect enabled, the server responded to the Telnet request with the name of the mail server, the version of SMTP supported, and the mail transfer agent (MTA) software in use: 220 mail.myserver.net ESMTP Postfix. With the SMTP inspect enabled, the firewall intercepts this reply and alters it to some- thing useless: This gives hackers much less to work with. Likewise, the inspect prevents the e