I'm new to CISCO and ACLs and NATs but I''m willing to learn.

I am having problems allowing FTP access through my ASA5505 ASA 9.2 (2) ASDM 7.3(3)

This is my problem, I have a domain which has my ASA Outside IP so I want to type the domain up in my ftp program (with user name and password) and be able to access to my NAS which is located behind my ASA.Passive is already on on the ASA and I tried active as well. I can see the ASA is denying the connection.

I had previously an Asus N56U router/firewall/dmz and I didn't have a problem with anything.So I know it's the ASA.

I don't know if this is important but my network configuration lays out like this:

Internet (Comcast cable modem) => ASA5505 => Switch ( and then from this switch it goes to a second switch (all in the same network) where the NAS is at.

It doesn't have anything to do with it right ? Should I use a DMZ ? Just for the NAS ? or it doesn't matter ?

I even did a 'fixup protocol ftp 21' (Honestly I don't know why or what it does) I found a few posts saying it fix the problem so I did it.It didn't fix anything , the FTP session times out anyway.

FTP to the NAS from inside my LAN works fine. (I type + User name and Password on Filezilla and no problems), but the problem its coming from the outside with myhomeftp.net. I haven't found one defenitive way that works (like a standard procedure) to Allow FTP connection behind an asa5505 (It confuse me), there's many ways to do this ??

I succesfully port forwarded udp traffic to another specific host to be able to play on Tunngle. I thought FTP would be like that, man I was wrong...I thought it was just to declare NAT and ACL and thats it.

If you notice the Nats rules for the FTP look like "nat (any,outside)" If I change "any" to "inside" ASDM gives me an error saying it can't reserve the ports and erase the NATs rules for FTP and FTP-data.

I haven't have any success working with the FTP protocol,thanks in advance guys.

ASA Version 9.2(2)

hostname asa5505

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain



interface Ethernet0/0

switchport access vlan 2


interface Ethernet0/1


interface Ethernet0/2


interface Ethernet0/3


interface Ethernet0/4


interface Ethernet0/5


interface Ethernet0/6


interface Ethernet0/7


interface Vlan1

nameif inside

security-level 100

ip address


interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute


boot system disk0:/asa922-k8.bin

ftp mode passive

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network obj-


object network obj-


object network obj_any


object network FTP


object network FTP_DATA


object-group service DM_INLINE_TCP_2 tcp

access-list outside_access_in remark Tunngle gaming

access-list outside_access_in extended permit udp any4 object obj- 
eq 11155

access-list outside_access_in extended permit tcp any4 object FTP eq ftp

access-list outside_access_in extended permit tcp any4 object FTP eq ftp-data

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-733.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected


object network obj-

nat (inside,outside) static interface service udp 11155 11155

object network obj-

nat (inside,outside) dynamic interface

object network obj_any

nat (inside,outside) dynamic interface

object network FTP

nat (any,outside) static interface service tcp ftp ftp

object network FTP_DATA

nat (any,outside) static interface service tcp ftp-data ftp-data

access-group outside_access_in in interface outside

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http inside

no snmp-server location

no snmp-server contact

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh stricthostkeycheck

ssh inside

ssh timeout 10

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd auto_config outside


dhcpd address inside

dhcpd enable inside


threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept



username Don password xFknmwCuNrTVsX3C encrypted

username Don attributes

service-type admin


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny 

inspect sunrpc

inspect xdmcp

inspect sip 

inspect netbios

inspect tftp

inspect ip-options


service-policy global_policy global

prompt hostname context

no call-home reporting anonymous


profile CiscoTAC-1

no active

destination address http 


destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily


: end

I'd recommend using a less involved firewall at this point, based on the description of your problem and the steps you've taken so far. A Meraki Z1 or MX64 may be more appealing.

It sounds like you have ONE public IP address, so you can do this entirely in the ASDM with port mapping rules in the NAT Rules screen. However, your firewall access rule with need to be source ANY to destination ANY.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.