topic huge files are not transferring - csc-ssm, cisco asa in Network Security

huge files are not transferring - csc-ssm, cisco asa

secureIT — Mon, 11 Mar 2019 20:58:35 GMT

Hi Netpro Team,

I am using csc-ssm module in Cisco ASA 5520 firewall, with the csc version as 6.3.1172.0. I have a public Ftp server and when i ever i transfer the zipped files more than 50 MB or 70 MB or more than that, it fails. I used to upload by clicking the ftp site and copy past the file to the location. After a certain point of time, the download fails with the below error on the explorer.

An error occured copying a file to the FTP server. Make sure tou have permission to put file on the server.

Details:

The operation timedout

Firewall log is below.

ABCFTP1|21|10.120.110.162|1257|Teardown TCP connection 48091783 for Internet:ABCFTP1/21 to XYZ:10.120.110.162/1257 duration 0:00:27 bytes 656 TCP FINs .

-- When i remove the service policy from the firewall, and try to transfer the files, it goes through without any problem. ena

-- Pls check the attached screenshot of the ftp settings in CSC-ssm. There is no problem with downloading files from the server.

huge files are not transferring - csc-ssm, cisco asa

varrao — Wed, 13 Jul 2011 14:10:13 GMT

Check if you have this option enabled :

You need to check the action specified for large file handling for more than 50 MB, try checking the option for enable deferred scanning.

Thanks,

Varun

huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 02:58:02 GMT

Thanks for the update Varun.

In my thread itself there is an attachement, where i have already enabled it for 75MB large file handling and enabled deferred scanning for 10MB.

pls suggest me at the earliest...

huge files are not transferring - csc-ssm, cisco asa

varrao — Thu, 14 Jul 2011 03:13:23 GMT

Hi Rajesh,

Please enabled the deferred scanning to 1 MB instead of 10 MB and check if that makes some difference.

Thanks,

Varun

huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 03:16:04 GMT

Hi Varun,

i shall do the changes accordingly... could you let me know any other settings to be changed and checked on priority...

regards

Rajesh

huge files are not transferring - csc-ssm, cisco asa

varrao — Thu, 14 Jul 2011 03:22:51 GMT

Do you have any logs or debugs when you face this issue??? Those woudl also be helpful

Varun

huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 03:28:28 GMT

This is the only log i saw in the log window of ASA.

ABCFTP1|21|10.120.110.162|1257|Teardown TCP connection 48091783 for Internet:ABCFTP1/21 to XYZ:10.120.110.162/1257 duration 0:00:27 bytes 656 TCP FINs

Can u pls let me know what all are the logs reqd if not the above...the commands also would be helpful.

--Rajesh

Re: huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 10:16:03 GMT

Hi All,

Pls find the below FIN timeout while the copying was got disconnected automatically..

6__jul 7 2011__12:15:50__302014__abc_ftp1__21__10.120.110.162__1181__Teardown TCP connection 48081758 for Internet:abc_ftp1/21 to interface_dmz:10.120.110.162/1181 duration 0:11:35 bytes 590 FIN Timeout

6__jul 7 2011__12:15:26__302013__10.120.110.162__1265__abc_ftp1__21__Built outbound TCP connection 48095714 for Internet:abc_ftp1/21 (abc_ftp1/21) to interface_dmz:10.120.110.162/1265 (EXT_NATed_interface_dmz/47374)

6__jul 7 2011__12:13:26__303002__10.120.110.162__1259__abc_ftp1__21__FTP connection from interface_dmz:10.120.110.162/1259 to Internet:abc_ftp1/21, user ibsftp Stored file 2_1_1_hotfix_36_rollup.zip

6__jul 7 2011__12:13:25__302013__10.120.110.162__1261__abc_ftp1__22882__Built outbound TCP connection 48093156 for Internet:abc_ftp1/22882 (abc_ftp1/22882) to interface_dmz:10.120.110.162/1261 (EXT_NATed_interface_dmz/60551)

6__jul 7 2011__12:13:24__302014__abc_ftp1__34886__10.120.110.162__1260__Teardown TCP connection 48093107 for Internet:abc_ftp1/34886 to interface_dmz:10.120.110.162/1260 duration 0:00:00 bytes 853 TCP FINs

6__jul 7 2011__12:13:23__302013__10.120.110.162__1260__abc_ftp1__34886__Built outbound TCP connection 48093107 for Internet:abc_ftp1/34886 (abc_ftp1/34886) to interface_dmz:10.120.110.162/1260 (EXT_NATed_interface_dmz/14139)

6__jul 7 2011__12:13:19__302013__10.120.110.162__1259__abc_ftp1__21__Built outbound TCP connection 48093016 for Internet:abc_ftp1/21 (abc_ftp1/21) to interface_dmz:10.120.110.162/1259 (EXT_NATed_interface_dmz/52582)

6__jul 7 2011__12:12:47__302014__abc_ftp1__21__10.120.110.162__1257__Teardown TCP connection 48091783 for Internet:abc_ftp1/21 to interface_dmz:10.120.110.162/1257 duration 0:00:27 bytes 656 TCP FINs

6__jul 7 2011__12:12:19__302013__10.120.110.162__1257__abc_ftp1__21__Built outbound TCP connection 48091783 for Internet:abc_ftp1/21 (abc_ftp1/21) to interface_dmz:10.120.110.162/1257 (EXT_NATed_interface_dmz/50080).

CAN SOMEONE HELP ME....

huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 11:40:03 GMT

Hi Varun,

Could you please check the above logs..........

FIN Timeout --> Force termination after 10 minutes awaiting the last ACK or after half-closed timeout. this is the meaning.

Can you pls let me know what could have gone wrong.

huge files are not transferring - csc-ssm, cisco asa

varrao — Thu, 14 Jul 2011 11:49:42 GMT

Hi Rajesh,

Did you try the enable deferred scanning for 1 MB??

Varun

huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 12:00:50 GMT

Hi Varun,

Thanks for the update!!!

I shall check this and update you in 1hr....

if i configure it for 1MB, all files exceeding 1MB data would be placed in the deferred scanning right and if any virus is there in the data, the server would be affect as well right ??

huge files are not transferring - csc-ssm, cisco asa

varrao — Thu, 14 Jul 2011 12:06:41 GMT

No Rajesh, deferred scanning means, it would download 1 mB of data and then scan it and send it to across, if you do not have deferred scanning enabled, then CSC would first download the complete 75 MB first and then scan the file and send it.

Thanks,

Varun

huge files are not transferring - csc-ssm, cisco asa

jyothydas — Thu, 14 Jul 2011 12:21:17 GMT

Varun, the info on CSC states differently.

Does this mean, it caches and then scans?

huge files are not transferring - csc-ssm, cisco asa

secureIT — Thu, 14 Jul 2011 12:35:16 GMT

Hi Varun,

Enabling The deferred scan wasn't successful, as it was failing. Any alternate ways ?

huge files are not transferring - csc-ssm, cisco asa

varrao — Thu, 14 Jul 2011 13:13:10 GMT

Hi Rajesh,

Thsi might need detailed investigation so I would suggest you to open a TAC case for it, so that the engineer can take debugs and logs from the firewall, moreover might need to reimage and upgarde the CSC to latest software version.

Thanks,

Varun

huge files are not transferring - csc-ssm, cisco asa

varrao — Thu, 14 Jul 2011 13:15:40 GMT

Hi Jyothdas,

Deferred scanning mean if any files size is greater than 1 MB, the CSC module would scan the file as it gets downloaded and send it to the client machine, it would not wait for the complete file to be downloaded and then scanned, yes it might not scan in detail and thats why you ahve the warning, but for large files, it fasters the process.

Thanks,

Varun

huge files are not transferring - csc-ssm, cisco asa

secureIT — Fri, 15 Jul 2011 07:07:06 GMT

Hi Varun,

Upgrade thru tredmicro csc, Administration > Product Upgrade

option is okay for updaing the .pkg file ??

Does it require the ASA device to reboot or can we do it without affecting it ??

I suppose, the reimage require the old lic file, config bkup etc.

rajesh

huge files are not transferring - csc-ssm, cisco asa

varrao — Fri, 15 Jul 2011 07:37:37 GMT

Hi Rajesh,

Upgarde doesn't require any reload.

Here is a very good for CSC re-image:

https://supportforums.cisco.com/docs/DOC-1323

Hope this helps

Thanks,

Varun