Solved

Cisco ASA incoming FTP connections problem when "inspect" IS enabled.

Posted on 2008-06-16
7
1,097 Views
Last Modified: 2008-09-27
Hi All.

We have a Cisco ASA 5505 providing security for 2x servers in a data-centre. The servers behind the firewall both host FTP servers of their own and connect outbound to other FTP servers.

First problem we had was FTP from the internet to the servers was not working. We got rid of the "inspect ftp" statement - and all was fine. This unfortunatly causes problems with FTP connects these servers make to other servers out on the internet.

Any advise would be apprechiated.


Cheers,
0
Comment
Question by:SynergyWorks
7 Comments
 

Author Comment

by:SynergyWorks
ID: 21793240
Hi.

I have re-enabled inspect FTP and this gives me working FTP out to the internet... and allows clients to connect to our servers using active FTP only. Passive fails.

How the heck do we get passive to go through this ASA 5505? I have enabed the FTP servet to use Passive ports 32000 > 33000 and forwarded these in the ASA.


Cheers,

Rob
0
 
LVL 16

Expert Comment

by:2PiFL
ID: 21793336
In addition to the above;

(config)#ftp mode passive
0
 

Author Comment

by:SynergyWorks
ID: 21793349
ftp mode passive is already present :(

Note: If I remove the 'inspect ftp' statement - all works fine (Passive & Active) but the servers then can't access other FTP sites out on the internet. It fails at the port command.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 7

Expert Comment

by:naughton
ID: 21797248
have you permitted both ftp and ftp-data into the firewall>
0
 

Author Comment

by:SynergyWorks
ID: 21797257
Yup.

If I remove "inspect ftp" statement... all works fine... (passive and active ftp to our server) but I need to keep that statement so us downloading things from the internet (ISO mirrors etc) still works.


Cheers,
0
 
LVL 1

Expert Comment

by:bkrontz
ID: 22239879
I'm having the same issues. Ugh.
0
 

Accepted Solution

by:
SynergyWorks earned 0 total points
ID: 22538529
For us a change of FTP server software seemed to work. I guess it was crap software not doing what it should and upsetting the firewall.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASA Restarted Suddenly 11 86
Palo Alto Firewall Startup Page 3 42
Configuring SonicWALL NS 2600 to work with Barracuda BESS 4 66
Which the best UTM recommended ? 2 94
Optimal Xbox 360 connectivity requires "OPEN NAT". If you use Juniper Netscreen or SSG firewall products in a home setting, the following steps will allow you get rid of the dreaded warning screen below and achieve the best online gaming environment…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now