CAUSE
The Cisco PIX firewall appliance uses an SMTP protocol filtering feature called Mailguard. Mailguard blocks all Extended Simple Mail Transfer Protocol (ESMTP) commands and allows only seven basic SMTP commands to pass.
The Mailguard feature is intended to help protect weakly secured mail servers. If a server is already well configured, and has the latest security patches and fixes from the SMTP vendor, Mailguard is not required.
There is a known issue with Mailguard that causes duplicate inbound messages. To check for the presence of Mailguard, from a workstation on the internet open a telnet session to port 25 of the Exchange IMS. You should see something similar to the following:
220 *********0*****************************************************************
************2*************
Now issue the EHLO command. You may see the following:
ehlo
500 Unrecognized command
In a typical SMTP session, a sending host marks the end of the DATA portion of the message with CRLF.CRLF on a line by itself. The receiving host acknowledges receipt of the message data by issuing a 250 OK response back to the sending host. The sending host replies with the QUIT command. The normal response from the receiving host would be 221 closing connection. Once the sending host receives this last response, the session is complete.
If for any reason the CRLF.CRLF terminating string is broken into separate packets during transmission, Mailguard rejects it and does not pass it to the mail server. The connection eventually times out and the message queues for delivery on the receiving host. Because the sending host never receives confirmation of receipt, it assumes delivery failure. It re-queues the message for attempted delivery at a later time. This goes on repeatedly until the message time-out on the sending host is exhausted.
Further testing with SMTP Protocol Logging can be used to pinpoint the failure in a message session. From a sample captured SMTP log below, observe the missing response of the receiving host to the CRLF.CRLF command.
2/7/01 5:01:20 PM : A connection was accepted from mail.domain1.com
2/7/01 5:01:21 PM : <<< HELO mail.domain1.com
2/7/01 5:01:21 PM : >>> 250 OK
2/7/01 5:01:21 PM : <<< MAIL From:<user@domain1.com>
2/7/01 5:01:21 PM : >>> 250 OK - mail from <user@domain1.com>
2/7/01 5:01:22 PM : <<< RCPT To:<user@domain2.com>
2/7/01 5:01:22 PM : >>> 250 OK - Recipient <user@domain2.com>
2/7/01 5:01:23 PM : <<< DATA
2/7/01 5:01:23 PM : >>> 354 Send data. End with CRLF.CRLF
2/7/01 5:05:44 PM : A connection was accepted from mail.domain3.com