All Email Security Gateways in use with Cisco network hardware, all firmware versions.
If enabled, the Email Security Gateway will advertise TLS (secure connection availability) for all incoming SMTP connections (for information on configuring this, see Solution #00000992). It's possible the sending mail servers aren't electing to send mail over TLS.
If it's been configured correctly and the sending servers are trying to send mail over TLS, the problem could be that a device between the sending servers and the Email Security Gateway is interfering. For instance, a Cisco PIX firewall with the "SMTP Fixup protocol" enabled will mask the 250-STARTTLS echo reply from the Email Security Gateway, preventing the sending mail server from realizing that sending mail using a secure connection is an option. The only solution in this case is to disable the "SMTP Fixup protocol" on the Cisco PIX firewall (for instructions on how to do this, click here).
Cisco ASA firewalls may also interfere with the 250-STARTTLS SMTP response, but they can be explicitly configured to support ESMTP over TLS. If you are using a Cisco ASA firewall, click here for instructions on how to enable this functionality.
The Cisco PIX "SMTP Fixup protocol" can cause other problems when used with the Email Security Gateway. For more information, see Solution #00001728.
Link to This Page: