SMTP - large files blocked

[IThack]

Anyone familiar with this error message:

%FW-3-SMTP_UNSUPPORTED_PARAMETER: Unsupported
SMTP parameter (Data Size (> 20000000)) from initiator

Our exchange server is being blocked by the cisco 1841, when sending emails larger than 20Mb. Not sure how to change the config to stop the router from blocking SMTP traffic going out.

 

[jneiberger]

Why are you sending invidividual emails that large?? SMTP is not a file transfer protocol. If you need to transfer large files, choose a protocol that is suited to the task.

 

[IThack]

That's what exchange server does. Not unusual to attach a 15Mb file to emails these days.

Anyway, SMTP works well via another router, but get blocked by the cisco. Is this a "built-in" function of the cisco, or is it something you can configure. Looking at the config, there doesn't seem to be anything that refers to checking files.

 

[jneiberger]

The router is blissfully unaware of the traffic, and it certainly doesn't care about the size of your file unless you have configured some feature that makes it application-aware, which it appears that you've done.

What else do you have running on that router?

 

[jneiberger]

Ah, you have CBAC configured. Here is the output from Cisco's Error Message Decoder:

%FW-3-SMTP_UNSUPPORTED_PARAMETER:   Unsupported SMTP parameter ([chars]) from initiator ([IP_address]:[dec])

The CBAC code has detected an invalid or unsupported parameter in an SMTP command. The parameter "@ or # to ETRN" means that the initiator is trying to send an invalid etrn command. This message is for informational purposes only, but may indicate a security problem.

Recommended Action: If you suspect a security problem, perform actions to correct the problem.

Related documents- No specific documents apply to this error message.

I've never used CBAC before, so I can't help you directly. However, you could probably find the answer to the problem by reading about CBAC on Cisco's site. There may be a parameter you could tweak to bump up the supported SMTP data size.

 

[ADB100]

I had a similar issue when my ISP enabled SMTP Authentication, I also have CBAC configured. I resolved it by disabling Outbound SMTP inspection if that is any help to you?

Andy

 

[IThack]

Yes, it's CBAC.

The important line in the config is:

ip inspect name outbound smtp

From investigation, the default is to limit data size to 20Mb, hence the problem (defaults don't appear in the config)

FYI, the config is not of my doing. And I suspect that it's been done by someone using some config software, possibly SDM. I can' think why else some odd entries woud be there:

ip inspect name outbound cuseeme
ip inspect name outbound ftp
ip inspect name outbound h323
ip inspect name outbound netshow
ip inspect name outbound rcmd
ip inspect name outbound realaudio
ip inspect name outbound rtsp
ip inspect name outbound smtp
ip inspect name outbound sqlnet
ip inspect name outbound streamworks
ip inspect name outbound tftp
ip inspect name outbound tcp
ip inspect name outbound udp
ip inspect name outbound vdolive

 

[KiscoKid]

It's not the router that's setting a limit to 20mb. It's the email server sending the SMTP command SIZE which tries to notify what its maximum allowed message size is. Check the email server and see if it has a max message size set.

This message is not an error. It's purely informational in that the router is telling you it doesn't understand the SMTP command SIZE.

 

[KiscoKid]

I had another thought about this. If the router supports ESMTP (I suspect it may need a decent firewall IOS umage though), you can disable SMTP inspection and instead enable inspect Extended SMTP (ESMTP).

I vaguely remember that ESMTP IOS firewalls understand the SMTP SIZE command.

 

[IThack]

It's not the mail server, it *is* the cisco. It stats on the website that the default size limit is 20Mb. You can change it though.

The IOS is new enough to support ESMTP, so I've changed to that, and set the size limit to 50Mb.

Now when a large email is sent, the ISP's server says "too big", and the exchange server stops trying to send it. The problem with cisco's CBAC is that there's no error message sent, so the exchange server continues to retry. And as the cisco doesn't give en error until AFTER 20Mb had been sent, the result was a choked internet pipe until the message was either deleted manually or time out trying (2 days).