Solved

Cisco ASA incoming FTP connections problem when "inspect" IS enabled.

Posted on 2008-06-16
7
1,096 Views
Last Modified: 2008-09-27
Hi All.

We have a Cisco ASA 5505 providing security for 2x servers in a data-centre. The servers behind the firewall both host FTP servers of their own and connect outbound to other FTP servers.

First problem we had was FTP from the internet to the servers was not working. We got rid of the "inspect ftp" statement - and all was fine. This unfortunatly causes problems with FTP connects these servers make to other servers out on the internet.

Any advise would be apprechiated.


Cheers,
0
Comment
Question by:SynergyWorks
7 Comments
 

Author Comment

by:SynergyWorks
ID: 21793240
Hi.

I have re-enabled inspect FTP and this gives me working FTP out to the internet... and allows clients to connect to our servers using active FTP only. Passive fails.

How the heck do we get passive to go through this ASA 5505? I have enabed the FTP servet to use Passive ports 32000 > 33000 and forwarded these in the ASA.


Cheers,

Rob
0
 
LVL 16

Expert Comment

by:2PiFL
ID: 21793336
In addition to the above;

(config)#ftp mode passive
0
 

Author Comment

by:SynergyWorks
ID: 21793349
ftp mode passive is already present :(

Note: If I remove the 'inspect ftp' statement - all works fine (Passive & Active) but the servers then can't access other FTP sites out on the internet. It fails at the port command.
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 7

Expert Comment

by:naughton
ID: 21797248
have you permitted both ftp and ftp-data into the firewall>
0
 

Author Comment

by:SynergyWorks
ID: 21797257
Yup.

If I remove "inspect ftp" statement... all works fine... (passive and active ftp to our server) but I need to keep that statement so us downloading things from the internet (ISO mirrors etc) still works.


Cheers,
0
 
LVL 1

Expert Comment

by:bkrontz
ID: 22239879
I'm having the same issues. Ugh.
0
 

Accepted Solution

by:
SynergyWorks earned 0 total points
ID: 22538529
For us a change of FTP server software seemed to work. I guess it was crap software not doing what it should and upsetting the firewall.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now