topic Re: ftp passive mode in Network Security

ftp passive mode

mekael.itzik — Mon, 11 Mar 2019 16:31:02 GMT

ASA 5505 Version 8.2(1)

Hi,

I have one PC that has to connect to public FTP in passive mode.

But if I understand right in pasive mode PC connects

to randomally data port of server.

What do I have to specify in confoguration of ASA 5505:

Open for PC all ports of specified FTP address

or to give range of data ports that server assigns randomally.

Re: ftp passive mode

Patrick0711 — Sat, 24 Oct 2009 02:54:36 GMT

Enable the FTP inspection in the global policy-map. This will dynamically open the PASV port ranges will NAT the PASV IP to it's public counterpart if necessary.

With this configuration, you will only need to open port 21 inbound for each host that is to connect via FTP.

policy-map global_policy

class inspection_default

inspect ftp

This link explain the fixup protocol

http://www.ciscopress.com/articles/article.asp?p=24685

Re: ftp passive mode

mekael.itzik — Sat, 24 Oct 2009 12:59:37 GMT

Thank you , it works!