Configure Cisco PIX 515e to allow ftp traffic

Posted on 2007-09-29
Last Modified: 2012-06-27
I am having problems configuring a PIX 515e to allow ftp traffic to a Windows 2k3 Server.

The ftp box is at and I am able to ftp from inside but am having problems hitting it from outside.

The outside IP address I have for the ftp server is x.x.x.x

Attached is my config file. I don't know what I am missing.

Please advise:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security4

: end
Question by:marduk666777666
    LVL 79

    Accepted Solution

    >PIX Version 6.3(3)
    There are some bugs in this PIX OS version. Suggest saving the config that you have (it looks correct) and reboot the PIX.
    If that doesn't work, check the default gateway of the FTP server.
    Check access list hitcounters
      show access-list internet

    Highly suggest upgrading to at least 6.3(5). You might even consider upgrading to 7.x or even 8.x. 8.0 has some really neat features and the ASDM GUI is out of this world...

    FYI - your global default route makes all of your static routes to the same gateway superfulous and unnecessary. I believe in a clean uncluttered config and would get rid of them.
    I would also suggest using a network object-group for your blocked hosts. It is easier to add/subtract individual hosts/subnets from the group than to add/subtract individual access-list entries, and your access-list stays a streamlined 2 lines long no matter how many blocked hosts.

    LVL 2

    Expert Comment

    Possible solutions for you:
    1) Remove fixup protocol ftp 21
    2) Upgrade to the latest GD release of PIX IOS

    LVL 2

    Expert Comment

    Please, go ahead and remove it immediately if it's a security concern.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Join & Write a Comment

    From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
    Managing 24/7 IT Operations is a hands-on job and indeed a difficult one. Over the years I have found some simple tips and techniques to increase the efficiency of the overall operations. The core concept has always been on continuous improvement; a…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    25 Experts available now in Live!

    Get 1:1 Help Now