When ESMTP inspection in enabled on ASA/FTD device and you try to telnet to exchange server, you see rows of Asterisks and cause failure with sending email to exchange server. As these devices are you gateway, when you try to connect your on-prem exchange with cloud-based solutions like O365 or Mimecast, you have this issue.

ESMTP is enabled by default on ASA and ASA running FTD code, whereas it is disabled by default on FTD appliances.

You can go to verification section to identify if ESMTP is enabled on your firewall.

Verification of ESMTP inspection from CLI

1. Connect to ASA/FTD CLI via SSH
2. Enter command ‘system support diagnostic-cli’ to enter ASA CLI
3. Enter command ‘enable’ to gain admin access, enable password is blank (just press Enter)
4. Enter command ‘show running-configuration’
5. Scroll down to the end section “policy-map global_policy”
   • If you see ‘inspect esmtp’, this means ESMTP inspection is enabled, else means it is disabled.

Disable ESMTP Inspection via FMC GUI

1. Login to FMC GUI
2. Navigate to Object à FlexConfig à TextObject
3. Open ‘disableInspectProtocolList’
4. Add ‘esmtp’ to the list and Save
5. Navigate to Devices à FlexConfig
6. Create ‘New Policy’ or ‘Edit’ existing policy you have and is applied to the device you want to push this setting
7. Select ‘Default_Inspection_Protocol_Disable’ from left tab and click right-arrow add button to add it to “Selected Prepend FlexConfigs”
8. You can click on magnifying lens button to see the configuration it will push and verify it has ESMTP in the list
9. Click on ‘Policy Assignment’ and add the device from the list you want to deploy this configuration to device.
10. Save and Deploy the configuration

Once deployed, use the Verification step to verify that ‘inspect esmtp’ is now removed

Disable ESMTP via FTD/ASA running FTD code Command Line Interface (CLI)

1. Login to FTD/ASA via CLI
2. Enter command ‘configure inspection esmtp disable’
   1. Note – This will disable ESMTP inspection only on this device, if you are running FTD in HA or Cluster, please push the configuration thru FMC/FDM interface instead of CLI.
3. You can verify as mentioned above in verification section