topic Re: allow FTP site in Network Security

allow FTP site

1salvarez — Mon, 11 Mar 2019 19:16:57 GMT

Noob here. I want to allow an ftp site for our users. I know how to do it via ASDM but have been wanting to use CLI.Looked online but haven't been able to find what i'm looking for.

Re: allow FTP site

Federico Coto Fajardo — Tue, 30 Nov 2010 20:21:01 GMT

Hi,

To allow FTP traffic you need a static NAT rule to allow access to the FTP server and an ACL allowing the ports.

i.e.

Let's say your internal FTP is 10.1.1.1 and the public IP will be 200.1.1.1

So, you requiere a static translation rule (ASDM or CLI) and an ACL permitting FTP from any source to the public IP.

If you want to do it via CLI you can post the following:

sh run static

sh run access-group

sh run access-list NAME --> change NAME for the name of the ACL applied to the outside interface

Federico.

Re: allow FTP site

1salvarez — Thu, 02 Dec 2010 19:50:01 GMT

Thanx

Re: allow FTP site

Federico Coto Fajardo — Thu, 02 Dec 2010 19:56:21 GMT

What is the IP of the FTP server behind the ASA?

Adding to the list you will need:

static (in,out) tcp PUBLIC_IP 21 PRIVATE_IP 21

access-list outside_access_in permit tcp any host PUBLIC_IP eq 21

Federico.

Re: allow FTP site

1salvarez — Thu, 02 Dec 2010 20:29:32 GMT

We dont have FTP server. This is for ftp sites that we need to access

. For example thru ASDM to allow acces to an FTP site I would go to Configuration>Firewall>Objects>Network Objects/Groups> and I'll add the IP and name.

See attached.

Re: allow FTP site

Federico Coto Fajardo — Thu, 02 Dec 2010 20:58:54 GMT

If it's to allow outbound FTP access to an external server, you should add the IP of the server to the object-group.

If from an internal computer you try to connect to this new FTP server what happen?

Can you reach it via telnet x.x.x.x 2?

Federico.

Re: allow FTP site

cadet alain — Thu, 02 Dec 2010 21:02:31 GMT

hi,

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/objectgroups.html

Re: allow FTP site

1salvarez — Fri, 03 Dec 2010 17:43:44 GMT

Thanx for your help guys. That doc looks like what

I am looking for.