ISA 2006 SE FTP Rule

That is the exact way the rule is set right now.

Are you using IE as an FTP Client?,...or using a real FTP Client?

OK - can you open the ISA gui, select monitoring - logging - start query
try the ftp access again and from ISA, what are you seeing in the realtime log?

1. Using IE. Yes, I know, I hate it as well, but the business wants it to work with IE.

2. The errors I see are listed in the original question. The FTP conenction is accepted, and then I receive the next 2 errors in order.

You need to verify that the FTP with ISA actually works. You have to remove IE from the picture to do this:

1. Open a persistant command prompt window ("cmd" from the Run Line)
2. Type "ftp ftp.hp.com" <enter>
3. User: anonymous
4. Pwd:  <your email address or make up a fake one>
5.  Type "dir"

You should see a directory listing of the HP ftp server.  If these steps worked then your ISA is fine.  There is nothing else to do on the ISA....the problem is with IE.

Now with IE,...go to ftp://ftp.hp.com
1. If it fails,..let if fail,... then....
2. Go up to the Page Menu at the upper right of the browser window
3. Select "Log on to FTP site with Windows Explorer"

What does it do?

There would be more than this in the output - just giving the words does not give the picture

Ok, using WS_FTP, here is the results/errors I receive in the ISA logs;

Log Time      Destination IP      Destination Port      Protocol      Action      Rule      Client IP      Client Username      Source Network      Destination Network      HTTP Method      URL      Error Information      Transport      Service      Original Client IP      Client Agent      Authenticated Client      Server Name      Referring Server      Destination Host Name      MIME Type      Object Source      Source Proxy      Destination Proxy      Bidirectional      Client Host Name      Filter Information      Network Interface      Raw IP Header      Raw Payload      GMT Log Time      Source Port      Processing Time      Bytes Sent      Bytes Received      Result Code      HTTP Status Code      Cache Information      Log Record Type      Authentication Server
10/9/2009 2:34:10 PM      10.248.129.68      21      FTP      Initiated Connection      All      10.251.8.190            Internal      Local Host      -      -      0x0      TCP            10.251.8.190                  PRO1VM00011ISA      -            -                                    -                        10/9/2009 12:34:10 PM      3649      0      0      0      0x0 ERROR_SUCCESS            0x0      Firewall      -
10/9/2009 2:34:10 PM      10.248.129.68      21      FTP      Closed Connection      All      10.251.8.190            Internal      Local Host      -      -      0x0      TCP            10.251.8.190                  PRO1VM00011ISA      -            -                                    -                        10/9/2009 12:34:10 PM      3649      422      0      30      0x80074e24 FWX_E_CONNECTION_KILLED            0x0      Firewall      -

The connection fails.

A little more info from WS_FTP log

Finding Host pro1vm00011isa.inapps.inergyautomotive.com ...
Internal Firewall Type 3 Specified
Connecting to 10.248.129.68:21
Connected to 10.248.129.68:21 in 0.125002 seconds, Waiting for Server Response
220  
OPEN ftp.hp.com
550 Access is denied.

Hi,

When you create an FTP server publishing rule, the FTP filter is configured as read only by default, and FTP uploads are blocked. To change this setting, right-click the rule, and select Configure FTP. Clear the Read Only checkbox, click OK, and then click Apply.                      

Ahmed.

ftp.hp.com will not care about read-only status or not as the site automatically defaults to providing a DIR or LS function to display its directory contents when used through the browser.

From a 'full' ftp client such ws_ftp, you will first be prompted for the username and password.

The output of your log looks like the traffic is not even getting past the ISA server.

So I went back to the basics, and turned off the ISA/Firewall services, and just tried to do this right from the proxy server, and i'm getting the results, which leads me to believe this problem is on the firewall in front of the proxy server itself.

I'll let you know where I stand once I get an analysis on the firewall.

The comments already provided - by various individuals - demonstrate that ISA is operating as expected. Throw it pwindell's way 25529164 as the points are of no interest to me.

keith