Can not connect to FTP after install of new firewall

We installed a new firewal and now can not connect to any FTP sites.  We get an error 255.  

Any ideas?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

mjimison1956Author Commented:
The secure ftp seems to work and within firewall it seems to work.  When we try to run automated scripts that have run for two years with out incident and bring a file in to process from ftp sites we get the following error:  I have put xxxxx in for the ip address for obvious reasons

Processing paused for 60 seconds (Attempt: 3)

  1  ftp> Connected to   2  ftp> OPEN xxxxxxxxxx
  3  Not connected.   4  ftp> USER C0rN3r *******
  5  Not connected.   6  ftp> binary
  7  Not connected.   8  ftp> cd ToTMS
  9  Not connected.   10  ftp> put c:\ecometry\ftproot\TRAVELftp\
  11  Not connected.   12  ftp> put c:\ecometry\ftproot\TRAVELftp\
  13  QUIT

Is the new firewall configured to to allow ftp (port 21) out?

Were you using active or passive FTP for the data connections?  Make sure that the firewall is configured to allow those ports out?

If you have access to the old firewall, you should look at its configuration to see how it handled FTP.

Are you supposed to be doing "secured ftp" to with this ftp server?  If so, is is ssh ftp or ftp ssl?
mjimison1956Author Commented:
We seem to be able to ftp inside the firewall but nothing from outside where we log in and get or put files.  I am the dba and not an expert on this and of course the network guys say it is the scripts (which have worked for two years until this morning immediately after the firewall know how that is)

I am not sure if active or passive?  Have to find out.  Unless you can tell me a way to check it without the network guys.

It is port 21 for sure.

where would I compare the configuration on old and new or would I not have access to that.  I have root on the unix boxes...  please let me know we are 12 hours behind now on prod processing
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

mjimison1956Author Commented:
From Network guys:

From as best as I can tell, the rules that allow FTP traffic look identical to the ones that were in there before the rebuild.  We are able to connect to SSL Ftp sites, but not unsecured FTP sites.  I’ve left word with Tom to see if he can help walk me through some additional troubleshooting.  I’ll update everyone once I hear back from him
Most Unix systems today default to passive.  The only way to really tell is to do a ftp and see which command is used, PORT or PASV after the GET/PUT command is issued.  PORT means active FTP and PASV is for passive.

Did the IP address that is seen at the server side change?  If so, the server side could have ACL setup to only allow specific IP addresses in.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mjimison1956Author Commented:
I see a PORT after doing a put inside the firewall. So active.

IP address did not change.  When you say server side are you talking about our server side where we are running the script to put the file?  If so where would I find this ACL config file?

I know I am fishing here...but got to hook something.
mjimison1956Author Commented:
This is the result of 'put' from my desktop to one of the unix servers.  Not sure this helps.  Can ftp like that but ftp in from remote server gets the error above in my initial post.

From my pc:

ftp> put script.txt
200 PORT command successful.
150 Opening ASCII mode data connection for script.txt.
226 Transfer complete.
"Server side" in this case is from the ftp point of view.  So in this case you are the ftp client (even though you may be running the script on a "server") and the remote site is the ftp server (even though the ftp server software may be running on a desktop or another server).

PORT means you are active.  If it was passive you would/should see something like:

227 Entering Passive Mode (x,x,x,x,y,y)

You may want to have them check the type of firewall.  Some firewalls will "snoop" on the command/control session and they will see the port being used for the data connection and then dynamically create a rule that allows the data connection to be established.  Some firewalls must have the ftp data ACL's pre defined.

Also, because of the way active ftp works, the data connection is actually initiated from the ftp server.  The ftp server will use source port 20 and connect to the destination port (your side) that is specified in the port command.

What you may want to try is before you issue the put command issue the command "passive".  Hopefully this may put your ftp client in passive mode and it is possible that your firewall may allow this out.  

This does assume that it is the firewall that is causing the problem in the first place.
mjimison1956Author Commented:
So do we change to ftp pasv in the script?
Yes, anyplace in the script after you have succesfully logged on.  Generally if I need to do passive I do it right before the 1st get/put statment.  You may want to double check that your ftp client supports it before you change the script.
mjimison1956Author Commented:
perfect solution. thank you.  ever need Oracle help...I am here
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Unix OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.