RE: Cisco PIX fixup protocol command

From: Chris Curtiss (chrisc_at_VistaPrint.com)
Date: 02/11/04

  • Next message: Michael Gale: "Re: Securing webmail - changing a port necessary to ensure security?" 
    Date: Wed, 11 Feb 2004 14:02:24 -0500
To: "S.Rohit" <s.rohit@usa.net>, <security-basics@securityfocus.com>

    FWIW, I have experienced problems with fixup SMTP, using a Postfix relay behind a PIX 515e.

    There was a bug, reported fixed over a year ago by Cisco, relating to interoperability with Postfix, but I was still unable to make it play with a large set of inbound mail. We ended up having to turn it off and letting Postfix do its thing.

    The only opion offered by a Cisco consultant I know was "What's a Postfix, use Sendmail".

    Chris

    > -----Original Message-----
    > From: S.Rohit [mailto:s.rohit@usa.net]
    > Sent: Wednesday, February 11, 2004 5:53 AM
    > To: security-basics@securityfocus.com
    > Subject: Cisco PIX fixup protocol command
    >
    >
    > hi everyone....
    >
    > might sound like a very stupid question to ask, but i am
    > looking for info
    > on wat is the use of fixup protocol commands on the Cisco PIX
    > device. wat is
    > the exact usage and significance of this commands? and wat
    > are the security
    > implications of this command? i know that some fixup's like
    > say fixup protocol
    > smtp are good cos of the way they restrict the SMTP command
    > set but how about
    > the general syntax [no] fixup protocol [service] [port]? what
    > is this used for
    > and wat are the security implications for this?
    >
    > i am asking this because i'm seeing a recommendation in
    > some PIX hardening
    > guide to disable fixups or they flag fixups as a security
    > issue? y is tat?
    >
    > rohit
    >
    >
    >
    > --------------------------------------------------------------
    > -------------
    > Free trial: Astaro Security Linux -- firewall with Spam/Virus
    > Protection
    >
    > Protect your network with the comprehensive security solution that
    > integrates six applications for ease of use and lower TCO.
    >
    > Firewall - Virus protection - Spam protection - URL blocking - VPN
    > - Wireless security.
    >
    > Download 30-day evaluation at:
    > http://www.astaro.com/php/contact/securityfocus.php
    > --------------------------------------------------------------
    > --------------
    >
    >

    ---------------------------------------------------------------------------
    Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

    Protect your network with the comprehensive security solution that
    integrates six applications for ease of use and lower TCO.

    Firewall - Virus protection - Spam protection - URL blocking - VPN
    - Wireless security.

    Download 30-day evaluation at:
    http://www.astaro.com/php/contact/securityfocus.php
    ----------------------------------------------------------------------------

  • Next message: Michael Gale: "Re: Securing webmail - changing a port necessary to ensure security?"

    Relevant Pages

    • Re: Cisco PIX fixup protocol command
      ... The PIX is a stateful firewall and maintains state on ... The reason why a security evaluation might result in a recommendation to ... is no need to have the SMTP fixup enabled. ...
      (Security-Basics)
    • Re: Cisco PIX fixup protocol command
      ... The fixup means that it will add stateful connection tracking to the ... As far as security implications of 'no fixup', ... is a difficult way to hack a firewall anyhow... ... the syntax of 'no fixup protocol service port', ...
      (Security-Basics)
    • Re: SMTP 550 5.7.1 unable to relay for user@company.com
      ... This should be an easy one, you need to get into your PIX and into enable ... The Fixup Protocol for SMTP in the PIX only always the originaly 8 or so ... they need to be able to relay. ...
      (microsoft.public.exchange.admin)
    • RE: Cisco PIX fixup protocol command
      ... The fixup protocol is for application inspection for example the HTTP fixup ... to send a non-standard SMTP command to the server. ... > and wat are the security implications for this? ...
      (Security-Basics)
    • Re: Cisco PIX fixup protocol command
      ... The clear fixup command removes fixup commands from the configuration that you added. ... It does not remove the default fixup protocol commands. ... The show fixup command lists all values or the show fixup protocolprotocol command lists an individual protocol. ... IT Technical Security Officer ...
      (Security-Basics)