Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A client of mine has a IIS 7 FTP server in Active mode sitting behind a Cisco ASA 5505. This setup is known good, as external clients (once instructed on IE settings) are able to connect to the FTP server without a problem. Command-line FTP in Windows and FileZilla set to Active mode also work as expected.

A sister company of this client now has users trying to connect, but are unable to. Even when IE is configured properly and FileZilla is set to Active. It seems like the Command channel will sometimes make a connection, but the Data channel always fails. This sister company also uses a Cisco ASA 5505. I'm sure that the issue is the configuration of their ASA.

As seen in the config snippet below, their ASA has the "ftp mode passive" global configuration option enabled, and am pretty sure that's the issue. I'm trying to figure out what configurations to suggest that they add to their config, but I would really appreciate suggestions ... I'm an ASA novice, and still trying to get up to speed on the thing.

ASAVersion7.2(2)

!

**ftpmodepassive**

clocktimezoneEST-5

clocksummer-timeEDTrecurring

dnsserver-groupDefaultDNS

domain-namevbllc.com

same-security-trafficpermitinter-interface

same-security-trafficpermitintra-interface

access-listnonatextendedpermitip10.0.4.0255.255.255.0192.168.255.0255.255.255.0

access-listnonatextendedpermitip10.0.4.0255.255.255.010.0.0.0255.255.255.0

access-listnonatextendedpermitip10.0.4.0255.255.255.010.0.5.0255.255.255.0

access-listnonatextendedpermitipany10.0.14.0255.255.255.128

access-listny-vpnextendedpermitip10.0.4.0255.255.255.010.0.0.0255.255.255.0

access-listny-vpnextendedpermitip192.168.255.0255.255.255.010.0.0.0255.255.255.0

access-listacl_outside2extendedpermiticmpanyany

access-listacl_outside2extendedpermitiphost66.117.119.221host216.143.137.27

access-listacl_outside2extendedpermitiphost66.117.119.214host216.143.137.27

access-listOutsideNew_40_cryptomapextendedpermitip10.0.4.0255.255.255.010.0.5.0255.255.255.0

access-listOutsideOld_access_inextendedpermiticmpanyany

access-listSplitTunnel_splitTunnelAclstandardpermitany

access-listacl_outside_fiberextendedpermiticmpanyany

nopager

loggingenable

loggingbuffer-size10000

loggingbufferednotifications

loggingasdminformational

mtuOutsideOld1500

mtuInside1500

mtutest11500

mtuOutsideNew1500

mtuOutsideFiber1500

mtumanagement1500

iplocalpoolvpn192.168.255.1-192.168.255.254

iplocalpoolSplitTunnel10.0.14.50-10.0.14.99

icmpunreachablerate-limit1burst-size1

icmppermitanyOutsideOld

icmppermitanyInside

icmppermitanyOutsideNew

icmppermitanyOutsideFiber

asdmimagedisk0:/asdm-522.bin


noasdmhistoryenable

arptimeout14400

global(OutsideOld)1interface

global(OutsideNew)1interface

global(OutsideFiber)1interface

nat(Inside)0access-listnonat

nat(Inside)110.0.4.0255.255.255.0

static(Inside,OutsideNew)216.143.137.2710.0.4.5netmask255.255.255.255

access-groupOutsideOld_access_inininterfaceOutsideOld

access-groupacl_outside2ininterfaceOutsideNew

access-groupacl_outside_fiberininterfaceOutsideFiber

routeOutsideFiber0.0.0.00.0.0.065.220.55.2091track1

routeOutsideOld0.0.0.00.0.0.063.139.135.161100

routeInside152.179.153.229255.255.255.25510.0.4.110

routeOutsideNew208.110.65.18255.255.255.255216.143.137.251

routeOutsideNew0.0.0.00.0.0.0216.143.137.2550

routeOutsideFiber152.179.153.229255.255.255.25565.220.55.2091

timeoutxlate3:00:00

timeoutconn1:00:00half-closed0:10:00udp0:02:00icmp0:00:02

timeoutsunrpc0:10:00h3230:05:00h2251:00:00mgcp0:05:00mgcp-pat0:05:00

timeoutsip0:30:00sip_media0:02:00sip-invite0:03:00sip-disconnect0:02:00

timeoutuauth0:05:00absolute

group-policySplitTunnelinternal

group-policySplitTunnelattributes

wins-servervalue10.0.4.3

dns-servervalue10.0.4.310.0.4.4

vpn-tunnel-protocolIPSec

split-tunnel-policytunnelspecified

split-tunnel-network-listvalueSplitTunnel_splitTunnelAcl

default-domainvaluevbllc.com

group-policyremotevpninternal

group-policyremotevpnattributes

wins-servervalue10.0.4.310.0.0.2

dns-servervalue10.0.4.310.0.0.2
share|improve this question

1 Answer 1

Three things...

  • This is a very old Cisco ASA software version. If these are new devices, they should have shipped with a CD that contains newer software and GUI utilities (specifically the ASA and ASDM software images).

  • Since Cisco firewalls are protocol-aware (and inspect packets), you can enable ftp transfer through them by running the fixup protocol ftp 21 command on both ASA firewalls.

  • For Cisco firewall beginners, I recommend using the ASDM graphical interface. Of course, this is enhanced with newer software versions that what's currently installed...

share|improve this answer
    
Thanks EWWHITE. I get the feeling it'll be a cold day in heck before the other site's admin updates the ASA software :) I didn't think the Fixup command was available on ASAs. just on the older PIX firewalls. I will suggest it to them. Appreciate your help. –  user160062 Feb 14 '13 at 23:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.