| 12.3 |  | Attack Guards |
| 12.3.1 |  | Mail guard |

| This section will discuss the guards that can be put in place by the PIX Security Appliance in order to protect against various types of attacks. Students will learn how to configure the PIX to provide attack guards from attacks from the following sources:

- E-mail
- DNS-based attacks
- Fragmentation attacks
- Access attacks
- SYN floods

The first type of attack guard that will be discussed is Mail Guard. Mail Guard provides a safe conduit for Simple Mail Transfer Protocol (SMTP) connections from the outside to an inside e-mail server. Mail Guard enables administrators to deploy a mail server within the internal network, without it being exposed to known security problems that exist within some mail server implementations.

Mail Guard works by restricting the SMTP commands that are allowed through the PIX. Only the SMTP commands specified in RFC 821 section 4.5.1 are allowed to a mail server. These commands are the most basic and secure. Other commands that could compromise the security of the server or the internal network are restricted. The following are the commands allowed for a mail server:

- HELO
- MAIL
- RCPT
- DATA
- RSET
- NOOP
- QUIT

By default, the PIX inspects port 25 connections for SMTP traffic. If there are SMTP servers using ports other than port 25, these servers must use the fixup protocol smtp command so that the PIX Security Appliance will inspect these other ports for SMTP traffic.

Use the no form of the command to disable the inspection of traffic on the indicated port for SMTP connections. If the fixup protocol smtp command is not enabled for a given port, then potential mail server vulnerabilities are exposed.

The way to configure the PIX Security Appliance to inspect ports other than 25 for SMTP traffic is examined in the Command Reference.

| Web Links smtp commands http://www.ietf.org/rfc/rfc0821.txt http://www.cisco.com/en/US/products/ hw/vpndevc/ps2030/products_tech_note
09186a00800b2ecb.shtml