Solved

Enabling FTPS/PORT990 on Cisco ASA

Posted on 2012-03-14
2
1,423 Views
Last Modified: 2012-06-01
Im having a problem enabling FTPS/Port 990 on my Cisco ASA 5520
0
Comment
Question by:cisco_pro30
2 Comments
 

Author Comment

by:cisco_pro30
ID: 37720283
Here is what my policy map has in it.  



!
policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect pptp
!
0
 
LVL 6

Accepted Solution

by:
alienXeno earned 500 total points
ID: 37736622
In plain FTP, the firewall can inspect the control channel and hence it knows the port details of the data channel that is going to get established from the ftp server to the client.

This will enable the firewall to automatically open the data channel ports.

In FTPS, even the control channel traffic is encrypted, so the firewall can no longer inspect the details exchanged over the control port and hence the data channel connection attempt will fail.


Also , check http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_qanda_item09186a00805b87d8.shtml#q13
 

For this to work.

Create rules in your firewall as follows

 

1) Allow Any to FTPS server on port 990.

2) Allow FTPS Server port 989 to any.

 

This should allow the data channel tcp session to get established.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
There is a question posted at http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/Q_28324159.html (http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/Q_28324159.html) and i…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now