[SOLVED] Cisco ASA 8.4(1) ESMTP inspection causes deferred messages

[ewilen]

Since upgrading our border firewall to ASA 8.4(1), we'd experienced a fairly large number of deferred outbound messages. Interestingly, nearly every time I requeued a message, it would go through immediately.

Inbound mail was also affected, leading to NDR sent back to the sender.

Ultimately I traced this to a bug that had existed in older versions of ASA/PIX software, and which has apparently been reintroduced in ASA 8.4(1). (Either that or a similar bug.) The bug is described at Postfix Frequently Asked Questions

Deferrals seemed to be random, which I interpret as due to the fact that it would only affect messages where the "." and the "CRLF" at the end of the DATA portion of the SMTP transaction are sent in separate packets. When a message is requeued, I believe a new header field is added, which changes the content of the DATA statement so that the special characters wouldn't cross the packet boundary.

The solution for now is to turn off ESMTP inspection on the ASA. (ESMTP inspection is the revised version of Cisco's old "esmtp fixup".)

A real test would be to flush the queue before applying the fix, since I believe this doesn't change the data of the message. But after nearly 24 hours of problem-free email, I believe I've found the issue.

It's possible that modifying the values of smtp_pix_workaround_delay_time = 10s and smtp_pix_workaround_threshold_time = 500s in postfix could help. See Postfix Configuration Parameters

Another report of this issue is at networking-forum.com - View topic - esmtp inpsection