topic ACL allowing internal clients access to outside FTP data on cisc in Network Security

ACL allowing internal clients access to outside FTP data on cisco 3750

iosepmonica — Tue, 12 Mar 2019 01:24:12 GMT

Hi,

I have this ACL on a cisco 3750 for allowing internal clients to access outside FTP servers, and I am concerned about the security hole that the last statement it might create:

access-list 111 permit tcp 10.100.111.0 0.0.0.255 gt 1023 any eq ftp

access-list 111 permit tcp 10.100.111.0 0.0.0.255 gt 1023 any eq ftp-data

access-list 111 permit tcp 10.100.111.0 0.0.0.255 gt 1023 any gt 1023

This is the only way I could get internal clients to access FTP data outside the network/Internet.

The access-list is applied inbound on the VLAN interface on the 3750.

Will this expose clients to a security risk?

Thank you.

ACL allowing internal clients access to outside FTP data on cisc

Julio Carvajal — Fri, 05 Apr 2013 18:19:40 GMT

Hello,

So this is applied on the internal interface right??

What FTP mode are you running, if it's passive where the client innitiates both connectionns Control and data channel then you must have it like that... I mean it will not expose as this is traffic from your clients to the outside, not from outside to inside.. You follow me

Why don't you restrict traffic on the interface that is next to the outside world?

Regards,

ACL allowing internal clients access to outside FTP data on cisc

iosepmonica — Fri, 05 Apr 2013 18:43:42 GMT

Correct, this is applied on the internal interface, and it is for internal clients accessing FTP servers on the Internet mostly.

In a typical environment, I would do this on a firewall, but in this particular case, this client wants it on the internal L3 switch. This switch has an interface that connects to a gateway for Internet access.

No connections initiated from outside to the internal clients are allowed at all, and the traffic going to the Internet only includes FTP, NTP and DNS.

ACL allowing internal clients access to outside FTP data on cisc

Julio Carvajal — Fri, 05 Apr 2013 19:39:34 GMT

Hello,

Yes, so that would be the only way to make it happen as you will need some sort of inspection in order to open the right pinholes for the outgoing Data channel,

but if everything for out to in is being denied you should be good to go

Regards,

Remember to rate all of the helpful posts

Julio Carvajal Segura

ACL allowing internal clients access to outside FTP data on cisc

iosepmonica — Fri, 05 Apr 2013 19:51:52 GMT

Thank you very much!

ACL allowing internal clients access to outside FTP data on cisc

Julio Carvajal — Fri, 05 Apr 2013 19:59:03 GMT

Hello,

Hey man my pleasure,

Remember to rate all of the helpful posts and can you mark the question as answered?

Regards