topic Re: ASA5506 drops some files in passive FTP in Network Security

ASA5506 drops some files in passive FTP

Yura Kazakevich — Fri, 21 Feb 2020 16:59:00 GMT

Hi everyone,

Very strange issue with FTP inspection on Cisco ASA5506-X (9.8(2)20). Passive mode works fine, BUT not for all files...

For example (look at screenshot), user can download any file (txt) except this one 34313622.210.

As you can see at screenshot, size of downloaded file 34313622.210 is incorrect.

In Passive mode all other files can be downloaded without problems. The same issue from time to time apears for others users in different folders. I've checked these files - simple txt files. I can open them without problems on FTP server (Filezilla FTP 0.9.55) for reading or editing.

If I try download the "incorect" file (34313622.210) in Active mode - everything works fine! The issue persists in Passive mode ONLY.

When connection drops in PASV mode I see count of droped packets is growing in ASA. Invalid EPSV format drop grows as well:

Could somebody tell me how to solve it?

My configuration is pretty simple. I did it using this guide.

Re: ASA5506 drops some files in passive FTP

Dennis Mink — Tue, 26 Mar 2019 22:04:13 GMT

i suggest you raise this with TAC , based on

https://quickview.cloudapps.cisco.com/quickview/bug/CSCso23893

even though you are not running this version. Also test with ftp inspection turned off

Re: ASA5506 drops some files in passive FTP

Ilkin — Wed, 27 Mar 2019 13:37:16 GMT

Is this an IPv4 or IPv6 connection?

Re: ASA5506 drops some files in passive FTP

Yura Kazakevich — Wed, 27 Mar 2019 18:00:08 GMT

This is IPv4 connection.

Re: ASA5506 drops some files in passive FTP

Yura Kazakevich — Sat, 30 Mar 2019 10:44:19 GMT

Hi Ilkin,
Can you help? What info I need provide in order to solve issue?

Re: ASA5506 drops some files in passive FTP

Yura Kazakevich — Wed, 15 May 2019 16:05:46 GMT

I turned off inspection FTP and it helped. Passive mode is working properly now - no problems with files anymore.
Thank you!