Also... it looks like you're only allowing ftp-data inbound for a single device. This would need to be done for all of your FTP servers.
Main Topics
Browse All TopicsTrying to configure a Cisco ASA 5510 to allow passive FTP and the connections are failing. Bellow is the configuration. How do you allow passive FTP on the ASA?
User Access Verification
Password:
Type help or '?' for a list of available commands.
SPIRIT-ISLANDA-ASA2> en
Password: *****
SPIRIT-ISLANDA-ASA2# sh run
: Saved
:
ASA Version 7.2(1)
!
hostname SPIRIT-ISLANDA-ASA2
enable password 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
description OUT
nameif OUT
security-level 0
ip address 201.218.218.2 255.255.255.248
!
interface Ethernet0/1
description IN
nameif IN
security-level 100
ip address 10.10.10.1 255.255.255.252
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.5 255.255.255.0
management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
object-group icmp-type PING
description Pruebas de Ping
icmp-object echo
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded
access-list outside_access_in extended permit icmp any host 201.218.218.17 object-group PING
access-list outside_access_in extended permit tcp any host 201.218.218.17 eq telnet
access-list outside_access_in extended permit icmp any host 201.218.218.2 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.18 object-group PING
access-list outside_access_in extended permit tcp any host 201.218.218.18 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.18 eq ssh
access-list outside_access_in extended permit tcp any host 201.218.218.22 eq ssh
access-list outside_access_in extended permit icmp any host 201.218.218.22 object-group PING
access-list outside_access_in extended permit tcp any host 201.218.218.22 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.22 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.22 eq https
access-list outside_access_in extended permit tcp any host 201.218.218.18 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.18 eq https
access-list outside_access_in extended permit tcp any host 201.218.218.17 eq 161
access-list outside_access_in extended permit udp any host 201.218.218.17 eq snmp
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq 3389
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq 3389
access-list outside_access_in extended permit tcp any host 201.218.218.28 eq 3389
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq https
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq https
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq 8443
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq 8443
access-list outside_access_in extended permit icmp any host 201.218.218.26 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.27 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.28 object-group PING
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq www
access-list outside_access_in extended permit udp any host 201.218.218.26 eq domain
access-list outside_access_in extended permit udp any host 201.218.218.27 eq domain
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq domain
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq domain
access-list outside_access_in extended permit icmp any host 201.218.218.41 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.43 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.44 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.45 object-group PING
access-list outside_access_in extended permit icmp any host 201.218.218.42 object-group PING
access-list outside_access_in extended permit tcp any host 201.218.218.43 eq ssh
access-list outside_access_in extended permit tcp any host 201.218.218.44 eq ssh
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq ssh
access-list outside_access_in extended permit icmp any host 201.218.218.46 object-group PING
access-list outside_access_in extended permit tcp any host 201.218.218.46 eq ssh
access-list outside_access_in extended permit tcp any host 201.218.218.43 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.43 eq https
access-list outside_access_in extended permit tcp any host 201.218.218.44 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.46 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.46 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq smtp
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq domain
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq www
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq nntp
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq 2021
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq 1024
access-list outside_access_in extended permit tcp any host 201.218.218.29 eq 65535
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq domain
access-list outside_access_in extended permit udp any host 201.218.218.45 eq domain
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq ssh
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq ssh
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq pop3
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq imap4
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq 993
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq 995
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq smtp
access-list outside_access_in extended permit tcp any host 201.218.218.45 eq 587
access-list outside_access_in extended permit tcp any host 201.218.218.28 eq 81
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq 88
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq ftp-data
access-list outside_access_in extended permit udp any host 201.218.218.26 eq 20
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq 3306
access-list outside_access_in extended deny ip any any
access-list inside_access_in extended permit ip any any
pager lines 24
logging asdm informational
mtu OUT 1500
mtu IN 1500
mtu management 1500
no asdm history enable
arp timeout 14400
global (OUT) 1 201.218.218.16 netmask 255.255.255.240
nat (IN) 1 10.10.10.1 255.255.255.255
static (IN,OUT) 201.218.218.0 201.218.218.0 netmask 255.255.255.248
access-group outside_access_in in interface OUT
access-group inside_access_in in interface IN
route OUT 0.0.0.0 0.0.0.0 201.218.218.1 1
route IN 201.218.218.16 255.255.255.240 10.10.10.2 1
route IN 201.218.218.32 255.255.255.240 10.10.10.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.1.0 255.255.255.0 management
telnet timeout 5
ssh timeout 5
console timeout 0
!
!
prompt hostname context
Cryptochecksum:1fe47c45815
: end
SPIRIT-ISLANDA-ASA2#
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Here is the log
**** Normal connection START ****
Connecting to: 201.218.218.26
220 FTP Server ready.
USER xxxxxx
331 Password required for dev.
PASS xxxxxx
230 User dev logged in.
TYPE I
200 Type set to I
STRU F
200 Structure set to F.
MODE S
200 Mode set to S.
REST 0
350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer REST 1 350 Restarting at 1. Send STORE or RETRIEVE to initiate transfer REST 0 350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer CWD
501 Invalid number of arguments.
TYPE A
200 Type set to A
PORT 192,168,1,117,12,122
200 PORT command successful
LIST -la
150 Opening ASCII mode data connection for file list
226 Transfer complete.
**** Normal connection END ****
**** Passive connection START ****
Connecting to: 201.218.218.26
220 FTP Server ready.
USER xxxxxx
331 Password required for dev.
PASS xxxxxx
230 User dev logged in.
TYPE I
200 Type set to I
STRU F
200 Structure set to F.
MODE S
200 Mode set to S.
REST 0
350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer REST 1 350 Restarting at 1. Send STORE or RETRIEVE to initiate transfer REST 0 350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer CWD
501 Invalid number of arguments.
TYPE A
200 Type set to A
PASV
227 Entering Passive Mode (201,218,218,26,128,186).
**** Passive connection END ****
Your config is allowing ftp into five hosts: 18,22,26,27,46
Your config is only allowing ftp-data for one host: 26
access-list outside_access_in extended permit tcp any host 201.218.218.46 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.27 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.26 eq ftp-data
access-list outside_access_in extended permit tcp any host 201.218.218.22 eq ftp
access-list outside_access_in extended permit tcp any host 201.218.218.18 eq ftp
All in all I'm completely confused by the purpose of your firewall since there doesn't appear any NAT translation between the public IP's and generally what would be your internal private IP's.
For example, maybe 10.10.10.130 is mapped to the public IP of 201.218.218.26, and the firewall ACL's allow various traffic to pass from your public IP's to your private IP's.
Business Accounts
Answer for Membership
by: xephaelPosted on 2007-07-25 at 11:11:18ID: 19568202
Could you please post a log of the FTP session you're attempting to make through the ASA? Details about if it's inbound or outbound would also be appreciated.