topic The inspection is enabled. in Network Security

FTP Issue for Inbound connections

jasonw — Tue, 26 Mar 2019 00:56:33 GMT

Not sure what is wrong but something has broken lately with inbound FTP connections. we update to 9.1(6) and sense then Active FTP connections just don't work correctly. Can some one help?

Hello Jason,If the clients

joseoroz — Mon, 13 Jul 2015 22:42:17 GMT

Hello Jason,

If the clients are behind the firewall and active FTP is being used it will require to have the FTP inspection enabled.

You can confirm if this is enabled with the command show run policy-map.

Can you provide the output from the command show service-policy if you have the inspection enabled.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113110-asa-enable-ftp-00.html

If the connections are being established you can setup a capture with a circular buffer and confirm what happens at the end of the communication and analyse it with a packet sniffer.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/110117-asa-capture-asdm-config.html

here is the show run-policy--

jasonw — Tue, 14 Jul 2015 16:13:00 GMT

here is the show run-policy

-------------

Policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect sip
inspect xdmcp
class class-default
user-statistics accounting

-----------

The inspection is enabled.

joseoroz — Tue, 14 Jul 2015 18:03:47 GMT

The inspection is enabled. Now as I recommended before you may setup captures on the firewall to analyze the traffic and be able to determine the reason for the failure.

Can you confirm what is the problem. Are the connections failing to be established ? Are the connections dropping after a while?

You can run your test and gather the show service policy prior and after and confirm if there are drops related to the FTP inspection and if the counter increases.