Re: Firewalls breaking stuff: [Was re: fwtk]

[Dominik Miklaszewski <dmikey () mac com>]

"Marcus J. Ranum" wrote:

> Charles W. Swiger wrote:
> > To focus more on topics more relevant for this list, one of the biggest problems certain firewalls and mail proxies 
> > have is that they break the SMTP protocol.  For example, Cisco's PIX (with MailGuard?) attempts to proxy SMTP and 
> > breaks the state machine defined in RFC-821 or -822, as well as preventing ESMTP and violating the SMTP banner 
> > requirements.

[..]

I had few hot discussions with DNS admins out-there when my sendmail was doing strict DNS checks on MX, A and other 
ResolverOptions..
I eventually tunned it down to +DEFNAMES +RECURSE only as it turned out that DNS related RFCs are somewhat 
contradictory to SMTP related RFC when it comes to what's acceptable and what's not ....I had too many false positives 
from those uhmm.. "broken"(?) MTAs...
I actually can't imagine how for example, a load balanced SMTP installation can be RFC compliant...

Dominik

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards