ESMTP size violation

Question

I've recently started seeing messages like this on my firewall (separating my internal mail server from my DMZ antispam device). I'm not sure if this is tied in to any firewall IOS upgrades I've recently completed (recently went from 8.2.x to 8.3.1 to 8.4.1).
In between these messages, I see plenty of traffic on port 25 and mail is being received/delivered. I can't say for sure *all* mail is being received/delivered and there does seem to be a longer delay on messages in the mailserver queue.
%ASA-7-108006: Detected ESMTP size violation from inside:192.168.4.22/11142 to dmz:192.168.2.77/25; declared size is: 3997, actual size is 4256
%ASA-7-108006: Detected ESMTP size violation from dmz:192.168.2.77/60462 to inside:192.168.4.21/25; declared size is: 19681, actual size is 19708
%ASA-7-108006: Detected ESMTP size violation from dmz:192.168.2.77/45901 to inside:192.168.4.21/25; declared size is: 9214, actual size is 9216
I'm not sure if the ASA is just complaining, or actually dropping these packets - how can I find out more information on what the firewall is actually doing and what can I do to remedy this error?
Thanks,
Greg

Answer 1

You can remove this log message with option mask in custom policy for esmtp:
match ehlo-reply-parameter size
  mask
Full custom policy like this:
policy-map type inspect esmtp custom-smtp
parameters
  no mask-banner
  no mail-relay
  no special-character
  allow-tls
match cmd line length gt 512
  drop-connection log
match cmd RCPT count gt 100
  drop-connection log
match body line length gt 998
  log
match header line length gt 998
  drop-connection log
match sender-address length gt 320
  drop-connection log
match MIME filename length gt 255
  drop-connection log
match ehlo-reply-parameter size
  mask