.10.10 Connected to mail. myserver. net. Escape character is '^]'. EHLO someserver 502 Error: command not implemented Look at the items in bold, and compare the output to the previous example. With- out the SMTP fixup enabled, the server responded to the telnet request with the name of the mail server, the version of SMTP supported, and the mail transfer agent (MTA) software in use: 220 mail.myserver.net ESMTP Postfix. With the SMTP fixup enabled, the firewall intercepts this reply, and alters it to some- thing useless: This gives hackers much less to work with. Likewise, the fixup prevents the execution of the EHLO someserver command. Different fixups are enabled by default on different versions of the PIX OS. On Version 6.2, the default fixups are: fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 1720 fixup protocol rsh 514 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 Some of these fixups may not be needed and can be disabled, though they usually don't hurt anything when left active. To see which ones are active on your PIX, use the show fixup command. Here, you can see that I've disabled the H323, RSH, Skinny, and SQLNET fixups: PIX# sho fixup fixup protocol dns maximum-length 512 fixup protocol ftp 21 no fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 no fixup protocol rsh 514 Chapter 26: PIX Firewall Configuration fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 no fixup protocol skinny 2000 fixup protocol smtp 25 no fixup protocol sqlnet 1521 fixup protocol tftp 69 Each fixup addresses the needs of a specific protocol. See the Cisco documentation for details. Failover PIX firewalls can be configured in high-availability pairs. In this configuration, should the primary PIX fail, the secondary will take over. All PIX firewalls are capable of being configured for failover, except the 501 and 506e models. To use this feature, the PIX must be licensed for it. To determine whether your PIX is capable of 