This article applies to:
- Trustwave MailMarshal (SEG)
- Cisco PIX Firewall
Symptoms:
- Duplicate e-mail messages are received when MailMarshal SMTP is running behind a Cisco PIX firewall.
- Errors in the MailMarshal Sender Log appears as follows:
Event - SMTPSendAndExpect: Msg B00002c44b.00000001.mml Server <> <10.0.1.10> no response to "DATA" - err 10054 - WSAECONNRESET
- The message does get through to the recipient, but because of the error, MailMarshal continues to send the message again and again until it is manually killed in the outbound queues.
Causes:
The cause of this issue appears to relate to the "SMTP fixup command" in the PIX firewall software, which in most cases is enabled by default. This command restricts all access to mail servers to RFC 821 commands of DATA, HELO, MAIL, NOOP, QUIT, RCPT, and RSET.
Although MailMarshal, an ESMTP server, sends the message data in full, somehow the PIX firewall interferes with the 250 OK response, and this in turn makes MailMarshal believe an error has occurred, so it keeps sending the message repeatedly.
Reply:
The suggested fix from Cisco is to disable the fixup protocol SMTP 25 command when using PIX with ESMTP servers like MailMarshal. You can also try upgrading the PIX firewall software to the latest version available - some customers have reported improvements after doing this. Please contact Cisco for all technical support relating to PIX firewalls.
Note:
MailMarshal is not vulnerable to directory harvesting through the ESMTP VRFY command. MailMarshal replies to all VRFY requests with the ambiguous response 252, as allowed by Internet RFCs.
- This article was previously published as:
- NETIQKB28987
- Marshal KB213
