Configuring an Esmtp Inspection Policy Map for Additional Inspection Control
To specify actions when a message violates a parameter, create an ESMTP inspection policy map. You can then apply the inspection policy map when you enable ESMTP inspection according to the "Configuring Application Inspection" section on page 25-5.
To create an ESMTP inspection policy map, perform the following steps:
Step 1 (Optional) Add one or more regular expressions for use in traffic matching commands according to the "Creating a Regular Expression" section on page 21-12. See the types of text you can match in the match commands described in Step 3.
Step 2 (Optional) Create one or more regular expression class maps to group regular expressions according to the "Creating a Regular Expression Class Map" section on page 21-14.
Step 3 Create an ESMTP inspection policy map, enter the following command:
hostname(config)# policy-map type inspect esmtp policy_map_name hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration mode.
Step 4 (Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)# description string
Step 5 To apply actions to matching traffic, perform the following steps.
a. Specify traffic directly in the policy map using one of the match commands described in Step 3. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.
b. Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# {[drop [send-protocol-error] |
drop-connection [send-protocol-error]| mask | reset] [log] | rate-limit message_rate}
Not all options are available for each match or class command. See the CLI help or the Cisco Security Appliance Command Reference for the exact options available.
The drop keyword drops all packets that match.
The send-protocol-error keyword sends a protocol error message.
The drop-connection keyword drops the packet and closes the connection.
The mask keyword masks out the matching portion of the packet.
The reset keyword drops the packet, closes the connection, and sends a TCP reset to the server and/or client.
The log keyword, which you can use alone or with one of the other keywords, sends a system log message.
The rate-limit message_rate argument limits the rate of messages.
You can specify multiple class or match commands in the policy map. For information about the order of class and match commands, see the "Defining Actions in an Inspection Policy Map" section on page 21-8.
Step 6 To configure parameters that affect the inspection engine, perform the following steps: a. To enter parameters configuration mode, enter the following command:
| Chapter 25 Configuring Application Layer Protocol Inspection_
ESMTP Inspection ■
hostname(config-pmap)# parameters hostname(config-pmap-p)#
b. To configure a local domain name, enter the following command:
hostname(config-pmap-p)# mail-relay domain-name action [drop-connection | log]]
Where the drop-connection action closes the connection. The log action sends a system log message when this policy map matches traffic.
c. To enforce banner obfuscation, enter the following command:
hostname(config-pmap-p)# mask-banner d. (Optional) To detect special characters in sender or receiver email addresses, enter the following command:
hostname(config-pmap-p)# special-character action [drop-connection | log]]
Using this command detects pipe (I), backquote f) and null characters.
e. (Optional) To match the body length or body line length, enter the following command:
hostname(config-pmap-p)# match body [line] length gt length
Where length is the length of the message body or the length of a line in the message body.
f. (Optional) To match an ESMTP command verb, enter the following command:
hostname(config-pmap-p)# match cmd verb verb
Where verb is any of the following ESMTP commands:
auth|data|ehlo|etrn||helo|help|mail|noop|quit|rcpt|rset|saml|soml|vrfy g. (Optional) To match the number of recipient addresses, enter the following command:
hostname(config-pmap-p)# match cmd RCPT count gt count
Where count is the number of recipient addresses.
h. (Optional) To match the command line length, enter the following command:
hostname(config-pmap-p)# match cmd line length gt length
Where length is the command line length.
i. (Optional) To match the ehlo-reply-parameters, enter the following command:
hostname(config-pmap-p)# match ehlo-reply-parameter extensions
Where extensions are the ESMTP service extensions sent by the server in response to the EHLO message from the client. These extensions are implemented as a new command or as parameters to an existing command. extensions can be any of the following:
8bitmime|binarymime|checkpoint|dsn|ecode|etrn|others|pipelining|size|vrfy j. (Optional) To match the header length or header line length, enter the following command:
hostname(config-pmap-p)# match header [line] length gt length
Where length is the number of characters in the header or line. k. (Optional) To match the header to-fields count, enter the following command:
hostname(config-pmap-p)# match header to-fields count gt count
Where count is the number of recipients in the to-field of the header.
l. (Optional) To match the number of invalid recipients, enter the following command:
hostname(config-pmap-p)# match invalid-recipients count gt count
Where count is the number of invalid recipients. m. (Optional) To match the type of MIME encoding scheme used, enter the following command:
hostname(config-pmap-p)# match mime encoding [7bit|8bit|base64|binary|others| quoted-printable]
n. (Optional) To match the MIME filename length, enter the following command:
hostname(config-pmap-p)# match mime filename length gt length
Where length is the length of the filename in the range 1 to 1000. o. (Optional) To match the MIME file type, enter the following command:
hostname(config-pmap-p)# match mime filetype regex [name | class name]
Where name or class name is the regular expression that matches a file type or a class map. The regular expression used to match a class map can select multiple file types.
p. (Optional) To match a sender address, enter the following command:
hostname(config-pmap-p)# match sender-address regex [name | class name]
Where name or class name is the regular expression that matches a sender address or a class map. The regular expression used to match a class map can select multiple sender addresses.
q. (Optional) To match the length of a sender's address, enter the following command:
hostname(config-pmap-p)# match sender-address length gt length
Where length is the number of characters in the sender's address.
The following example shows how to define an ESMTP inspection policy map.
hostname(config)# regex userl "[email protected]" hostname(config)# regex user2 "[email protected]" hostname(config)# regex user3 "[email protected]" hostname(config)# class-map type regex senders_black_list hostname(config-cmap)# description "Regular expressions to filter out undesired senders" hostname(config-cmap)# match regex userl hostname(config-cmap)# match regex user2 hostname(config-cmap)# match regex user3
hostname(config)# policy-map type inspect esmtp advanced_esmtp_map hostname(config-pmap)# match sender-address regex class senders_black_list hostname(config-pmap-c)# drop-connection log hostname(config)# policy-map outside_policy hostname(config-pmap)# class inspection_default hostname(config-pmap-c)# inspect esmtp advanced_esmtp_map hostname(config)# service-policy outside_policy interface outside
Continue reading here: Configuring an FTP Inspection Policy Map for Additional Inspection Control
Was this article helpful?