Configuring for third party spam filtering.

[chrisbreyer]

I have a Cisco Pix 4.2.(3) protecting a GroupWise mail server. I recently signed up with a company called Postini for spam filtering and want to close all smtp traffic to my server with the exception of Postini's address ranges, and have two questions.

1) Do I need to turn off the fixup command for port 25 in order to deny general access to my mail server?

2) Postini lists a range of addresses they use (i.e. 64.18.0.0 - 64.18.15.255 with a netmask of 255.255.240.0 & 207.126.144.0 - 207.126.159.255 with a netmask of 255.255.240.0). I imagine I just need to create a conduit permit for this range on port 25 for my server's ip address, but I can't seem to find the appropriate syntax. Does anyone know the syntax I should be using?

Thank you,

Chris

[grant.maynard]

PIX 4.2(3) ? Wow.

1. No, fixup is an app layer inspection, it just looks at the SMTP commands and only allows the key ones. But some mail servers do not like it. Leave it on unless there's a problem.

2. Yes, good ol' conduits. Config guide at http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_42/pix42cfg/index.htm

[chrisbreyer]

Thank you for the fixup information. As for the conduit command, I spent quite a bit of time with the manual (and Google) before posting, but couldn't realize or come across the correct syntax, especially on how to properly enter the range of addresses to permit (e.g. 64.18.0.0 through 64.18.15.255). While my company's firewall might be ancient, I'm pretty new to this, and appreciate any further advice you might be able to offer.

Thank you again,

Chris

[grant.maynard]

static (inside, outside) mail_server_public_ip mail_server_internal_ip

conduit permit tcp host mail_server_public_ip eq 25 64.18.0.0 255.255.240.0

By default, PIX Firewall restricts all access to mail servers to RFC 821 section 4.5.1 commands of DATA, HELO, MAIL, NOOP, QUIT, RCPT, and RSET. This occurs via the Mail Guard service which is set with the following default configuration command:

fixup protocol smtp 25

You should consider upgrading to v7 for the new features and easier config. You'd have to check your DRAM and flash for that.

[chrisbreyer]

That was exactly what I needed. Many thanks for your help. Whenever I get better at this, I'll do the same for someone else some day.

- Chris