Re: Interop problem with SMTP STARTTLS and Cisco PIX firewall

> First, I am _not_ affiliated with the PIX group, but I have had my hand in
> getting this PIX misbehavior fixed a little over a year ago (in
> conjunction with broken PIX behavior related to DSN support reported on
> the Notifications mailing list by Matti Aarnio).  The Cisco defect number
> for the broken behavior is CSCdk22371.
> 
> As of PIX software version 4.2(2), the problem described below by Chris
> (and by CSCdk22371) has been fixed.  Version 4.2(2) has been shipping
> since approximately September 1998.
> 
> In PIX 4.2(2) the EHLO verb is treated as an invalid verb and causes a 550
> response -- thus the SMTP client won't see the list of SMTP service
> extensions supported by the SMTP server and won't try to use SMTP verbs
> outside of the set of required-to-implement verbs in RFC821.

I wouldn't call this a "fix", more of a stopgap measure.

The problem is that the firewall is preventing use of valuable
functionality.  It really needs to be configurable to allow use of
popular SMTP options, and to be able to advertise the EHLO keywords
associated with the options that are enabled.  There has been a 
tremendous demand for SMTP AUTH and STARTTLS; Internet fax stuff
needs DSN support.  etc, and Cisco is doing its customers a 
disservice if it cannot support them.

> 
> This issue was also recently mentioned by Joel Snyder, [email protected],
> in his Messaging Focus newsletter published by NetworkWorld Fusion.  I
> believe he, too, was using an old version of the PIX software.
> 
> If this problem exists in a version of the PIX software after 4.2(2),
> please let me know directly and I will escalate the issue.

The problem still exists, in that the firewall is still preventing
STARTTLS from being used.  It is therefore creating a security hole.

Keith