Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


(outside)---(ASA5510)---(inside) ->Windows2008 DC


..........->Win2008 FTP Server

Which Ports do I need to open from DMZ->Inside that FTP Users can authentificated on the Inside DC?

I have allready opend 389 (Ldap), 636 (secure Ldap) and 53 (dns). But the ftp Client stucks allways after processing the credentials and the FTP Server gives you an eventlog "logon error". the error messages indicates that there could be an issue with closed ports.

if I turn the ACL to "IP", that means all ports are open, everything is working fine.

share|improve this question
This KB article might be helpful: – davey Apr 23 '10 at 7:55
thank you, it was helpful. please use the "answer" function instead of comment, so that i can mark the question as answered. – sam Jul 22 '10 at 12:21

FTP uses two different TCP ports. Port 21 for ftp commands and port 20 for ftp data.

With only port 21 allowed through the firewall you would need to use a passive ftp connection.

You can switch to passive mode in the Microsoft command line ftp client by issuing the following command after login:


You should receive a 227 response to the effect of "Entering Passive Mode".

At this point you should be able to continue unfettered.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.