I'm new to CISCO and ACLs and NATs but I''m willing to learn.
I am having problems allowing FTP access through my ASA5505 ASA 9.2 (2) ASDM 7.3(3)
This is my problem, I have a domain which has my ASA Outside IP so I want to type the domain up in my ftp program (with user name and password) and be able to access to my NAS which is located behind my ASA.Passive is already on on the ASA and I tried active as well. I can see the ASA is denying the connection.
I had previously an Asus N56U router/firewall/dmz and I didn't have a problem with anything.So I know it's the ASA.
I don't know if this is important but my network configuration lays out like this:
Internet (Comcast cable modem) => ASA5505 => Switch (192.168.1.9) and then from this switch it goes to a second switch (all in the same network) where the NAS is at.
It doesn't have anything to do with it right ? Should I use a DMZ ? Just for the NAS ? or it doesn't matter ?
I even did a 'fixup protocol ftp 21' (Honestly I don't know why or what it does) I found a few posts saying it fix the problem so I did it.It didn't fix anything , the FTP session times out anyway.
FTP to the NAS from inside my LAN works fine. (I type 192.168.1.10 + User name and Password on Filezilla and no problems), but the problem its coming from the outside with myhomeftp.net. I haven't found one defenitive way that works (like a standard procedure) to Allow FTP connection behind an asa5505 (It confuse me), there's many ways to do this ??
I succesfully port forwarded udp traffic to another specific host to be able to play on Tunngle. I thought FTP would be like that, man I was wrong...I thought it was just to declare NAT and ACL and thats it.
If you notice the Nats rules for the FTP look like "nat (any,outside)" If I change "any" to "inside" ASDM gives me an error saying it can't reserve the ports and erase the NATs rules for FTP and FTP-data.
I haven't have any success working with the FTP protocol,thanks in advance guys.
ASA Version 9.2(2) ! hostname asa5505 xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address dhcp setroute ! boot system disk0:/asa922-k8.bin ftp mode passive same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj-192.168.1.15 host 192.168.1.15 object network obj-192.168.1.0 subnet 192.168.1.0 255.255.255.0 object network obj_any subnet 0.0.0.0 0.0.0.0 object network FTP host 192.168.1.10 object network FTP_DATA host 192.168.1.10 object-group service DM_INLINE_TCP_2 tcp access-list outside_access_in remark Tunngle gaming access-list outside_access_in extended permit udp any4 object obj-192.168.1.15 eq 11155 access-list outside_access_in extended permit tcp any4 object FTP eq ftp access-list outside_access_in extended permit tcp any4 object FTP eq ftp-data pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-733.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected ! object network obj-192.168.1.15 nat (inside,outside) static interface service udp 11155 11155 object network obj-192.168.1.0 nat (inside,outside) dynamic interface object network obj_any nat (inside,outside) dynamic interface object network FTP nat (any,outside) static interface service tcp ftp ftp object network FTP_DATA nat (any,outside) static interface service tcp ftp-data ftp-data access-group outside_access_in in interface outside timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact crypto ipsec security-association pmtu-aging infinite crypto ca trustpool policy telnet timeout 5 ssh stricthostkeycheck ssh 192.168.1.0 255.255.255.0 inside ssh timeout 10 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd auto_config outside ! dhcpd address 192.168.1.5-192.168.1.132 inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn anyconnect-essentials username Don password xFknmwCuNrTVsX3C encrypted username Don attributes service-type admin ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email firstname.lastname@example.org destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:c35ba40b6d6d3f411b03dfff22408298 : end