topic Re: FTP passive and active on ASA in Network Security

FTP passive and active on ASA

mbluemel — Tue, 12 Mar 2019 10:50:45 GMT

Hi all

I wonder if anyone can assist with this.

I have a customer with a 5505 ASA which has restrictions on outbound ports.

He needs to use both Active and Passive outbound FTP connections but I am struggling to have both running.

With inspect ftp disabled the passive works but not active.

If I enable inspect ftp the active works not passive.

Is there anyway to get them both working together as I cannot find any configuration examples and I am running out of ideas.

Thanks

Martin

Re: FTP passive and active on ASA

Florin Barhala — Thu, 10 May 2018 08:04:28 GMT

Do you have both active and passive connection requirements towards same FTP server or is it passive towards some FTP server and active toward another one?

Re: FTP passive and active on ASA

mbluemel — Thu, 10 May 2018 08:31:21 GMT

Hi there

Thanks for the interest.

Its passive to some and active to others.

Thanks

Martin

Re: FTP passive and active on ASA

Florin Barhala — Thu, 10 May 2018 09:05:48 GMT

That is good news!
What I would do: create a class-map and then apply inspect ftp for that class-map. Obviously that class-map will contain only the FTP server list IPs that require active FTP.
And for any other server passive will work fine.