Esmtp Inspection; Configuring An Esmtp Inspection Policy Map For Additional Inspection Control - Cisco PIX 500 Series Configuration Manual

ESMTP Inspection

hostname(config-cmap)# match not header-flag QR
hostname(config-cmap)# match question
hostname(config-cmap)# match not domain-name regex class my_domains
hostname(config)# policy-map type inspect dns serv_prot
hostname(config-pmap)# class pub_server_map
hostname(config-pmap-c)# drop log
hostname(config-pmap-c)# match header-flag RD
hostname(config-pmap-c)# mask log
hostname(config)# class-map dns_serv_map
hostname(config-cmap)# match default-inspection-traffic
hostname(config)# policy-map pub_policy
hostname(config-pmap)# class dns_serv_map
hostname(config-pmap-c)# inspect dns serv_prot
hostname(config)# service-policy pub_policy interface dmz
ESMTP Inspection
ESMTP inspection detects attacks, including spam, phising, malformed message attacks, buffer
overflow/underflow attacks. It also provides support for application security and protocol conformance,
which enforce the sanity of the ESMTP messages as well as detect several attacks, block
senders/receivers, and block mail relay.

Configuring an ESMTP Inspection Policy Map for Additional Inspection Control

To specify actions when a message violates a parameter, create an ESMTP inspection policy map. You
can then apply the inspection policy map when you enable ESMTP inspection according to the
"Configuring Application Inspection" section on page
To create an ESMTP inspection policy map, perform the following steps:
(Optional) Add one or more regular expressions for use in traffic matching commands according to the
Step 1
"Creating a Regular Expression" section on page
commands described in
(Optional) Create one or more regular expression class maps to group regular expressions according to
Step 2
the
Create an ESMTP inspection policy map, enter the following command:
Step 3
hostname(config)# policy-map type inspect esmtp policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
Step 4 (Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)# description string
To apply actions to matching traffic, perform the following steps.
Step 5
a.
Cisco Security Appliance Command Line Configuration Guide
25-24
Step 3.
"Creating a Regular Expression Class Map" section on page
Specify the traffic on which you want to perform actions using one of the following methods:
Chapter 25 Configuring Application Layer Protocol Inspection
25-5.
21-6. See the types of text you can match in the match
21-9.
OL-12172-03