topic inspect ftp protocol via zone based firewall in Network Security

inspect ftp protocol via zone based firewall

elnurh — Tue, 12 Mar 2019 06:20:15 GMT

Hi everybody guru. I have some issue with permit ftp traffic from zona A where locate my cient to zone B where locate my ftp server.

I permit via access list from network A to Network B the needed network and ports and in class map add ftp protocol. But the client can connect to ftp server, but cannot listing and downloading the soft from ftp server. In the client show timeout connection. How can I fix this issue.

thanks all before.

It's hard to say how to fix

Karsten Iwen — Mon, 27 Jul 2015 09:55:28 GMT

It's hard to say how to fix it as you don't show what you configured ... But it should work with a config like the following:

ip access-list ext FTP-COMMUNICATION
 permit ip 10.10.10.0 0.0.0.255 host 192.0.2.21
!
class-map type inspect match-all FTP-TO-SERVER
 match access-group name FTP-COMMUNICATION
 match protocol ftp

Here I only specify the L3 communication in the ACL, the information that it has to be FTP is taken from the match protocol.

there are piece of my config

elnurh — Tue, 28 Jul 2015 11:38:16 GMT

there are piece of my config

(

ip access-list extended from_term_to_servers

permit tcp object-group permit_terminal-point object-group servers eq 8091
permit udp object-group permit_terminal-point object-group servers eq ntp
permit tcp object-group permit_terminal-point object-group server_254.4 eq ftp
permit tcp object-group permit_terminal-point object-group server_254.4 eq ftp-data
permit tcp object-group permit_terminal-point object-group server_254.4 range 64000 65535

class-map type inspect match-any from_terminal
match access-group name from_term_to_servers
class-map type inspect match-any tcp_ftp
match protocol ftp
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-all term_net_servers
match class-map from_terminal
match class-map tcp_ftp

policy-map type inspect from_terminal_p
class type inspect term_net_servers
inspect
class class-default
drop

zone-pair security terminal_s source terminal destination ivlanA
service-policy type inspect from_terminal_p

)

but ftp protocol not working. How can I check that my rules and policy working right and may be issue is not in the router and ZBF ?

Build a new ACL only for the

Karsten Iwen — Tue, 28 Jul 2015 11:51:37 GMT

Build a new ACL only for the FTP-communication as shown above and it should work.

I did that you say about ftp?

elnurh — Wed, 05 Aug 2015 11:51:28 GMT

I did that you say about ftp? not working. I create certain access list for ftp, create class map include access list and protocol only ftp and place it in policy map, but the rule and ftp inspection not work. The have access to ftp server but cannot listing to directory and downloading anything.

What have you configured

Karsten Iwen — Wed, 05 Aug 2015 12:15:50 GMT

What have you configured exactly?

ip access-list extended ftp

elnurh — Wed, 05 Aug 2015 14:40:26 GMT

ip access-list extended ftp_term
permit tcp object-group permit_terminal-point object-group server eq ftp
permit tcp object-group permit_terminal-point object-group server eq ftp-data

class-map type inspect match-all ftp_for_term
match access-group name ftp_term
match protocol ftp

policy-map type inspect from_terminal_p
class type inspect term_net_servers
inspect
class type inspect ftp_for_term
inspect
class class-default
drop

and I need to inspect ftps

elnurh — Thu, 06 Aug 2015 08:06:01 GMT

and I need to inspect ftps too.

any one can help me in this issue ?