topic Re: Active FTP failing on ACE module in Application Networking

Active FTP failing on ACE module

JeramyKoval — Fri, 18 Dec 2009 17:17:50 GMT

I've setup FTP as show in the configuration examples. Passive FTP works fine but for some reason active FTP breaks.

The client reported that he can authenticate to the FTP server with no problem. However when he issues a FTP command such as LIST the connection just hangs. Eventually he has to abort the connection. 10.24.32.75 is my source NAT address.

PORT 10,24,32,75,239,165

200 PORT command successful.

LIST

150 Opening ASCII mode data connection for /bin/ls.

425 Can't open data connection.

When I look at the sniff trace between the NAT and server I see the ftp server initiate the ftp-data connection on port 20. But then the ACE receives it and sends a reset back to the ftp server.

Anyone know of commands that can be executed that can show details as to why the connection gets reset by the ACE?

I have a TAC case opened but still waiting for an engineer to respond. Just thought I'd post to see if anyone else has experienced this.

Re: Active FTP failing on ACE module

Eric Rose — Fri, 18 Dec 2009 18:57:30 GMT

It sounds like you probably didn't configure FTP INSPECT rule for this VIP.

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/security/guide/appinsp.html#wp1310518

The ACE performs the FTP command inspection process as follows:

•Prepares a dynamic secondary data connection. The channels are allocated in response to a file upload, a file download, or a directory listing event and must be prenegotiated. The port is negotiated through the PORT or PASV commands.

Thanks

Eric Rose

Re: Active FTP failing on ACE module

JeramyKoval — Fri, 18 Dec 2009 19:58:58 GMT

I triple checked that part of our configuration and made sure the inspect-ftp command was configured.

Re: Active FTP failing on ACE module

Gilles Dufour — Mon, 21 Dec 2009 19:42:38 GMT

We'll need to see your config and the sniffer trace.