topic Re: Passive FTP to External Server Closing Connection - MPF Prob in Network Security

Passive FTP to External Server Closing Connection - MPF Problem?

Mike Hendriks — Mon, 11 Mar 2019 19:33:22 GMT

Sometime shortly after deploying my ASA 5510, I was forced to remove the default global inspection policy in order to sort out an issue with TLS over SMTP. Today, I'm having problems accessing external hosts with FTP, even in passive mode. As an example, I can log into a remote server with no problem, but as soon as I issue an ls command, the session is disconnected. A packet trace reveals that I'm sending my inside RFC 1918 IP address out along with this ls command, and after that, the server is disconnecting me.

I have reconfigured a small portion of the default policy in an attempt to resolve the issue, to no avail. I have the following commands present:

class-map inspection_default
match default-inspection-traffic

policy-map global_policy
class inspection_default
inspect ftp

There are no other "policy-map type inspect ftp" commands present on the appliance.

Any guidance would be appreciated. I'm quite unfamiliar with the MPF on ASA 8. I have attempted to use this configuration example as a guide: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080aee442.shtml

I still haven't been able to figure it out, however.

Thanks,

Re: Passive FTP to External Server Closing Connection - MPF Prob

Mike Hendriks — Mon, 10 Jan 2011 22:38:05 GMT

From another post, I gleaned that some useful information be obtained with the show service-policy inspect ftp command. I have run it, and it returned no information. I take this to mean that my configuration is not in effect.

xxx5510# show service-policy inspect ftp
xxx5510#

Re: Passive FTP to External Server Closing Connection - MPF Prob

manish arora — Mon, 10 Jan 2011 22:43:24 GMT

Just do sh service-policy and see if you get any output ?

manish

Re: Passive FTP to External Server Closing Connection - MPF Prob

Mike Hendriks — Mon, 10 Jan 2011 22:44:37 GMT

xxx5510# show service-policy

xxx5510#

Re: Passive FTP to External Server Closing Connection - MPF Prob

manish arora — Mon, 10 Jan 2011 22:48:00 GMT

yeah, you need to apply the service policy using :-

asa(conf)#service-policy global_policy global

Given that when you run --> sh run policy map , you see policy-map global_policy

Manish