problem with passive FTP behind cisco asa firewall

Question

i've problems connecting to an ftp-server behind a cisco asa firewall using passive mode. ftp works using active and "extended passive" mode, however: when i turn off "extended passive" (epsv in ftp console client app), it does not work anylonger -- all commands result in a timeout. however we need non-"extended passive" mode for some application we use.

any ideas?

thanks, harald

UPDATE / SOLUTION

as it turns out, it was not exactly ASA's fault, or was it? i had to turn of masquerading in proftpd configuration. i had the masquerading-address in proftpd-config set to the IP address of the ftp-server domain and that resulted in unexpected things when passing traffic through the asa. now -- without address masquerading -- everything works very well.

Answer 1

You need to enable application-level filtering for FTP using the "fixup" command:

# fixup protocol ftp 21

There is this article on the PIX that also applies to ASA:

http://www.ciscopress.com/articles/article.asp?p=24685

Answer 2

The ASAs don't have a fixup command like the PIX did.

Are you using the default inspections on FTP traffic via a service policy rule?

Answer 3

You may need to create a rule to allow the Pasv ports, not just port 21. In your FTP program usually they have a configuration setting where you can specify customer Pasv port range. Specify some high range of ports say 45200 to 45500 or something like that. Then in your ASA allow those ports to the IP of the FTP server.

Answer 4

Hi try the following things:

ftp mode passive

policy-map global_policy

class inspection_default

inspect ftp

I am not exactely sure what the first command does, but i saw it in a couple of running configs. just give it a try

but i am quite sure that you need to create a policy-map with an ftp inspection. that's the thing they called fixup protocols on the pix before. it allows the asa to open a session when the opposition choose on whitch port they want to talk.

Answer 5

You could switch to using implicit SFTP instead and then you only need to worry about a single port to open.

Answer 6

I think ftp passive mode is for the asa (router itself) to send, or recieve configs to or from itself. Not for passing sessions. Just what I've found....

Answer 7

I was talking about the command "ftp mode passive" just to clarify.