How do I get passive FTP working on IIS 6.0 behind a PIX-520 firewall?

PIX 520 v 6.3(1)

Relevant config lines:
fixup protocol ftp 21
..
name Ex.tern.al.IP ServerName
..
access-list outside_access_in permit tcp any host ServerName eq ftp
access-list outside_access_in permit tcp any host ServerName eq ftp-data
access-list outside_access_in permit tcp any host ServerName range 5500 5600
..
static (inside,outside) ServerName In.tern.al.IP netmask 255.255.255.255 0 0

IIS 6.0 on Windows 2003 Server. Set the passive ports to 5500-5600 per http://support.microsoft.com/kb/555022/en-us

Can connect fine. Can transfer fine with active FTP, always could. When I try a passive transfer (even a directory listing,) all the client shows is "227 Entering Passive Mode (Ex,ter,nal,IP,21,144)." and eventually times out.

Using active transfer, the PIX log shows (when grepping for the client's external IP):
302013: Built inbound TCP connection 7092630 for outside:Cl.ie.nt.IP/31535 (Cl.ie.nt.IP/31535) to inside:In.tern.al.IP/20 (Ex.tern.al.IP/20)
302014: Teardown TCP connection 7092630 for outside:Cl.ie.nt.IP/31535 to inside:In.tern.al.IP/20 duration 0:00:01 bytes 68 TCP FINs
106015: Deny TCP (no connection) from In.tern.al.IP/20 to Cl.ie.nt.IP/31535 flags ACK  on interface inside

When trying a passive transfer, all I see in the PIX log is:
302013: Built inbound TCP connection 7092859 for outside:Cl.ie.nt.IP/31655 (Cl.ie.nt.IP/31655) to inside:In.tern.al.IP/5522 (Ex.tern.al.IP/5522)

Nothing shows up in the Windows event logs except the timeout warning event.

Any ideas what to check next?? This is driving me bonkers.Start Free Trial