Configuring Custom SMTP Inspection on Cisco ASA (Post-9.7)

Securing SMTP Traffic on Cisco ASA (Post 9.7)

In today’s email-driven world, securing your mail server is critical. SMTP is a frequent attack vector for spam, phishing, and DoS attempts. Starting with Cisco ASA 9.7, SMTP inspection configuration has become simpler, more flexible, and easier to manage using Layer-7 policy maps.

📧 SMTP Inspection Overview ➕

SMTP (Simple Mail Transfer Protocol) forms the backbone of email delivery but is also widely abused. With proper inspection, Cisco ASA can:

• Limit SMTP command usage
• Block risky commands like VRFY and EXPN
• Protect mail servers from abuse and DoS attacks

Before ASA 9.7, SMTP inspection relied on class maps and service policies. Now, everything can be configured directly inside an L7 inspection policy.

Step 1️⃣ Disable Default SMTP Inspection ➕

Cisco ASA enables SMTP inspection by default. To apply a custom policy, you must first disable the default rule to avoid conflicts.

policy-map global_policy class inspection_default no inspect esmtp

Why? Default inspection overrides custom rules if left enabled.

Step 2️⃣ Create an L7 SMTP Policy Map ➕

Starting with ASA 9.7, SMTP inspection is configured directly using an L7 policy map.

policy-map type inspect esmtp custom_smtp_policy

This policy will hold all SMTP command restrictions and limits.

Step 3️⃣ Control SMTP Commands & Limits ➕

Certain SMTP commands can be abused for reconnaissance and enumeration.

parameters no allow-vrfy no allow-expn

You can also protect against DoS attacks by limiting recipients per session:

limit recipients 100

Step 4️⃣ Apply SMTP Inspection Globally ➕

Match SMTP traffic and apply the inspection globally.

class-map smtp_class match port tcp eq 25

policy-map global_policy class smtp_class inspect esmtp custom_smtp_policy

Step 5️⃣ Verify SMTP Inspection ➕

Confirm that the SMTP inspection policy is active:

show service-policy inspect esmtp

✅ Conclusion ➕

Cisco ASA 9.7 introduced a cleaner and more powerful way to manage SMTP inspection. By disabling default inspection and applying a custom L7 policy, administrators gain precise control over SMTP behavior.

This approach enhances security, reduces attack surface, and allows rapid adaptation to evolving email threats.

💡 Key Takeaways

• SMTP is a common attack vector and must be inspected
• ASA 9.7 simplifies SMTP inspection using L7 policy maps
• Default inspection must be disabled for custom rules
• Blocking VRFY/EXPN reduces reconnaissance risks
• Command limits protect against DoS attacks

Interactive Cisco ASA SMTP Inspection Guide