topic Re: FTP in Network Security

FTP

Lewis_Cipher — Mon, 11 Mar 2019 19:49:37 GMT

I am trying to NAT my FTP to the outside. I can't get to that IP. Am I missing something? I have FTP allowed in access rules.

For NAT

static NAT

inside - to the internal IP

Outside - external IP

I can ping the server from firewall internally. What else can I do to test?

Re: FTP

PAUL GILBERT ARIAS — Fri, 11 Feb 2011 16:17:27 GMT

are you trying a static NAT for your FTP server?

For example:

FTP 192.168.1.10

NATed IP 66.12.66.10

stat (inside,outside) 66.12.66.10 192.168.1.10

Is that what you are trying?

Re: FTP

Lewis_Cipher — Fri, 11 Feb 2011 16:44:38 GMT

yes, do I have all the info correct?

Re: FTP

PAUL GILBERT ARIAS — Fri, 11 Feb 2011 16:52:06 GMT

if you have a similar static NAT it seems correct. Are there any ACLs on the inside interface that could prevent the traffic from going out. Is the NATed IP on your range of outside IPs?

If you can send the config it would be great.

Re: FTP

Lewis_Cipher — Fri, 11 Feb 2011 18:11:16 GMT

sent via private message....

Re: FTP

PAUL GILBERT ARIAS — Fri, 11 Feb 2011 19:32:04 GMT

thanks for the config. If you are trying to allow FTP traffic from the outside to the inside it won't work since you are denying the traffic in the first two lines of your access-l outside_access_in.

Is this the test that you are trying? FTP to the SGA_Website_NAT address coming from the outside?

Re: FTP

Lewis_Cipher — Fri, 11 Feb 2011 20:39:12 GMT

Hey Paul,

The Deny is on purpose unti l can get it to work I have it on deny. Yes the NAT is SGA_Website_NAT. It is called website becasue we got rid of that and I changed the nat for our FTP server now. I can get to the website internally, but not externally, when I try the NAT ip address on the outside...

Re: FTP

PAUL GILBERT ARIAS — Fri, 11 Feb 2011 20:44:16 GMT

do you see hitcounts on the ACL after the testing? If there are not hitcounts that means that the traffic is not getting to your ASA.

Re: FTP

Lewis_Cipher — Fri, 11 Feb 2011 21:22:22 GMT

It is weird becasue I do see hit counts, but can't get to address.

Re: FTP

PAUL GILBERT ARIAS — Fri, 11 Feb 2011 21:29:57 GMT

Your FTP server has a default gateway? It should be your ASA 10.1.101.1. Make sure the FTP service is up.

Re: FTP

Lewis_Cipher — Mon, 14 Feb 2011 16:48:19 GMT

I can get to the FTP Internally, I can ping the FTP from the ASA. I can't get the external IP to hit the internal via the internet. This one is bugging me. I run a packet trace from the External IP to the ASA and the packet succeeds. The Gateway of the FTP is the ASA IP. The services are running because I can get the FTP site in the DMZ zone. Any othe ideas?

Re: FTP

PAUL GILBERT ARIAS — Mon, 14 Feb 2011 16:54:34 GMT

do you have any other filtering device such as an IPS?

We could set some captures on the ASA inside interface to see if the packet returns to the ASA and how it returns.

Re: FTP

Lewis_Cipher — Mon, 14 Feb 2011 17:07:57 GMT

I am getting a failure when packet tracing from ASA to the FTP server on inside interface. Do I need to allow this internally... Any Less secure networks are allowed IP...

Re: FTP

Lewis_Cipher — Mon, 14 Feb 2011 17:09:53 GMT

No IPS

Re: FTP

Lewis_Cipher — Mon, 14 Feb 2011 20:54:57 GMT

I am checking to see if the Router is open to FTP... I will post back back in a few.

Re: FTP

PAUL GILBERT ARIAS — Mon, 14 Feb 2011 20:59:33 GMT

if the traffic is coming from outside to inside you just need the ACLs on the outside. Also make sure you have the inspect ftp on your policy map

Re: FTP

Lewis_Cipher — Tue, 15 Feb 2011 15:21:28 GMT

Inspect FTP on Policy Map?

Re: FTP

PAUL GILBERT ARIAS — Tue, 15 Feb 2011 15:25:19 GMT

yes, for example:

policy-map global_policy

class inspection_default

inspect ftp

service-policy global_policy global

Re: FTP

ciscona728 — Tue, 15 Feb 2011 16:57:09 GMT

Lewis,

Are you using ports 20 and 21 for FTP?

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807ee585.shtml

Re: FTP

Lewis_Cipher — Wed, 16 Feb 2011 14:40:11 GMT

FTP test I get this error????

Error: FEAT response lines must begin with a single space character