topic Re: Downloading IOS via FTP through ASA5512 not working in Network Security

Downloading IOS via FTP through ASA5512 not working

abideen.shaikh — Thu, 14 Jul 2022 13:53:45 GMT

Hi All,

I am trying to download IOS image in to ASA firewall . There is a OOB ASA firewall connection is traversing through to the FTP server.

When I am running a capture on the OOB ASA getting below captures

480: 12:30:05.219059 802.1Q vlan#xx8 P0 xx.xx.xx.35.5296 > xx.xx.xx.135.21: S 2607808118:2607808118(0) win 32768 <mss 1460,nop,nop,timestamp 3600727312 0>
482: 12:30:08.248293 802.1Q vlan#xx8 P0 xx.xx.xx.35.5296 > xx.xx.xx.135.21: S 2607808118:2607808118(0) win 32768 <mss 1460,nop,nop,timestamp 3600730343 0>
483: 12:30:14.267655 802.1Q vlan#xx8 P0 xx.xx.xx.35.5296 > xx.xx.xx.135.21: S 2607808118:2607808118(0) win 32768 <mss 1460,nop,nop,timestamp 3600736366 0>

I have policies in place on the OOB firewall and packet tracer is simulating allow as well.

I am able to ping the FTP server. From FTP server i can SSH to the device.

Please help me in troubleshooting this issue further.

xx.xx.xx.135 is the FTP server
xx.xx.xx.35 is the Firewall from where I am trying to download ios.

Below is the output from packet tracer.

input-interface: oob
input-status: up
input-line-status: up
output-interface: dcmgmt
output-status: up
output-line-status: up
Action: allow

Connection is getting out of the firewall hitting OOB firewall but seems like never leaving OOB firewall can not see any hits on the FTP server after running the wireshark.

Regards

Re: Downloading IOS via FTP through ASA5512 not working

MHM Cisco World — Thu, 14 Jul 2022 14:02:34 GMT

FTP need inspection to allow pass ASA, are you config inspection FTP ?

Re: Downloading IOS via FTP through ASA5512 not working

abideen.shaikh — Thu, 14 Jul 2022 15:05:42 GMT

Hi,

On the source ASA and on the OOB ASA on both of them below is enabled .

ftp mode passive

policy-map global_policy
class inspection_default

inspect ftp

Re: Downloading IOS via FTP through ASA5512 not working

balaji.bandi — Thu, 14 Jul 2022 15:35:39 GMT

how does your network looks like as you mentioned

ASA ---(another FW) --FTP ?

Re: Downloading IOS via FTP through ASA5512 not working

abideen.shaikh — Thu, 14 Jul 2022 15:53:37 GMT

Source ASA (xx.xx.xx.35) --- OOB ASA (xx.xx.xx.20)--- FTP (xx.xx.xx.135).

Thats correct

Re: Downloading IOS via FTP through ASA5512 not working

MHM Cisco World — Thu, 14 Jul 2022 15:59:53 GMT

according to your network you need to port forwarding in OOB ASA for FTP port.
otherwise the OOB will change the por.t if there is dynamic NAT.

Re: Downloading IOS via FTP through ASA5512 not working

balaji.bandi — Thu, 14 Jul 2022 16:01:23 GMT

easy method, Grab a USB stick and connect to ASA, (since this is one time requirement).

Re: Downloading IOS via FTP through ASA5512 not working

abideen.shaikh — Thu, 14 Jul 2022 21:09:57 GMT

Hey Balaji this is not one time there are several ASAs connected this way if we manage to get this one working then we can draft a procedure to upgrade all the ASAs as and when required.

Re: Downloading IOS via FTP through ASA5512 not working

abideen.shaikh — Thu, 14 Jul 2022 21:11:01 GMT

Thanks for sharing could you please share the command so ill try configuring port forwarding.

Re: Downloading IOS via FTP through ASA5512 not working

abideen.shaikh — Thu, 14 Jul 2022 21:21:01 GMT

Is there a way to establish it is not being dropped the OOB or source firewall itself. I have shared a capture in the initial message.

Re: Downloading IOS via FTP through ASA5512 not working

MHM Cisco World — Thu, 14 Jul 2022 21:24:13 GMT

https://www.petenetlive.com/KB/Article/0000772