SMTP problem

[cmptrnerd]

We have a possible pc affected with spyware that is sending SMTP mail. We also have an internal mail server and our ISP is reporting a lot of SMTP activity. I want to add an acl to only allow smtp mail internally from our 192.168.0.1.

Can anyone help me to get this command correct.



Mark

 

[cmptrnerd]

Also is there a way to monitor the SMTP traffic on the PIX since this would allow us to find the problem workstations.



Mark

 

[Supergrrover]

add an outbound ACL

access-list outbound permit tcp host [IP of internal Mail server] any eq 25
access-list outbound deny tcp any any eq 25 log
access-list outbound permit ip any any

access-group outbound in interface inside

When you check your logs there will be entries for the SMTP offenders.

Brent
Systems Engineer / Consultant
CCNP, CCSP