topic dropping packets on large FTP transfer in Network Security

dropping packets on large FTP transfer

ddacus — Mon, 11 Mar 2019 20:37:51 GMT

I am attempting to FTP to a remote site through a IPSEC tunnel.

When I am transfering large files the ASA5540 is showing syslog errors stating "connection timeout". What I think is happening is after about 1 hour the firewall is closing the connection control port for the FTP session and neither end is notified so eventually the transfer is stopped.

What do I need to modify in the FW to accommodate these larger files?

Thank you

Attached are the syslogs.

Re: dropping packets on large FTP transfer

Maykol Rojas — Tue, 24 May 2011 23:37:53 GMT

Hi,

You can use DCD for the control channel of FTP.

Check on this:

access-list dcd permit tcp host eq 21

class-map dcd

match access-list dcd

Policy-map global_policy

class dcd

set connection timeout dcd

That will send a proove to the client and the server to check if the connection is still up, or if it is down, if the both reply, the connection will be up, otherwise, it will be dropped.

Cheers

Mike