Solved

ASA FTP config using PAT

Posted on 2007-03-19
2
925 Views
Last Modified: 2008-11-08
PIX ASA FTP configuration for a PAT config. I can't seem to figure out if I should use ASDM for this and how. Can someone provide a ASA sample config for FTP access from all outside users. What should the STATIC command look like if I'm doing PAT and not static NAT (1 to 1) for teh FTP server? Where do I specify the internal address of my FTP server. I have inpsect ftp enabled (as its on by default).

Thanks-
0
Comment
Question by:murphymail
2 Comments
 
LVL 28

Expert Comment

by:batry_boy
Comment Utility
It will look like this:

static (dmz,outside) tcp interface 21 <real_ip_address> 21 netmask 255.255.255.255

This assumes your ftp server is on an interface named "dmz", that you want to use the firewall's public interface IP address for PAT, and that <real_ip_address> is the internal IP address of your ftp server.

Of course, you'll also need the appropriate ACL applied to the outside interface to allow the traffic through, like this:

access-list acl_outside_in permit tcp any host <public_ip_of_firewall> eq ftp
access-group acl_outside_in in interface outside
0
 
LVL 32

Accepted Solution

by:
rsivanandan earned 500 total points
Comment Utility
I guess the acl needs a small change;

>>access-list acl_outside_in permit tcp any host <public_ip_of_firewall> eq ftp

access-list acl_outside_in permit tcp any interface outside eq ftp


Or if you're doing the port forward using another ip address other than the one assigned on the outside interface, the syntax remains the same;

static (inside,outside) tcp <PublicIP> 21 <real_ip_address> 21 netmask 255.255.255.255

access-list acl_outside_in permit tcp any host <PublicIP> eq ftp
access-group acl_outside_in in interface outside

Cheers,
Rajesh
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
Transferring data across the virtual world became simpler but protecting it is becoming a real security challenge.  How to approach cyber security  in today's business world!
This video discusses moving either the default database or any database to a new volume.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now