topic Re: Large FTP file timed out in Network Security

Large FTP file timed out

santipongv — Mon, 11 Mar 2019 16:19:42 GMT

Users are experiencing FTP timed out for job that file is larger than 1 Gig on Windows 2003 servers. It seems to time out every 10 mins even they tried to increase time out to 20 mins but ftp job still failed. Is there a way we can increase FTP timeout on firewall? Thank you in advance.

Re: Large FTP file timed out

Yudong Wu — Fri, 25 Sep 2009 19:21:55 GMT

If it is PIX/ASA, you can use "timeout conn" to increase tcp timeout. But I am not sure if the problem is on PIX/ASA. What's your current tcp timeout setting?

Re: Large FTP file timed out

santipongv — Fri, 25 Sep 2009 19:23:18 GMT

timeout xlate 1:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

Re: Large FTP file timed out

Yudong Wu — Fri, 25 Sep 2009 19:26:55 GMT

So your tcp timeout is 1 hour. Are you sure it's FW to close the connection. Can you check log to see what the reason is for the connection to be tear down.

Re: Large FTP file timed out

santipongv — Fri, 25 Sep 2009 19:29:56 GMT

ASA log shows the ftp session was torn down by ASA. It seems that FTP session (communication port 21) was timed out then session was torn down.

Re: Large FTP file timed out

Yudong Wu — Fri, 25 Sep 2009 19:31:36 GMT

what's your asa version.

Re: Large FTP file timed out

santipongv — Fri, 25 Sep 2009 19:34:57 GMT

7.2(2)22

Re: Large FTP file timed out

Yudong Wu — Fri, 25 Sep 2009 19:47:38 GMT

Since you mentioned control channel (port 21) was timeout, I thought it might be related to bug CSCsc91450. But your version should have the fix.

You might try use policy map to change tcp timeout just for FTP/21 connection.

1. define FTP traffic in ACL

2. Define class-map

3. use policy-map and add the following command in the class defined in step 2

"set connection timeout tcp 02:00:00 reset"

4. Apply it to the interface.

If its still not working, open TAC case to investigation.

Re: Large FTP file timed out

santipongv — Fri, 25 Sep 2009 19:52:39 GMT

But my tcp timeout was set to 1 hr? Why FTP/21 is terminated at 10 mins range?

Re: Large FTP file timed out

santipongv — Fri, 25 Sep 2009 19:53:18 GMT

Is it possible to use a tcp-map to change just the timeout for the session in question?

Re: Large FTP file timed out

Yudong Wu — Fri, 25 Sep 2009 19:57:31 GMT

I don't remember the detail of the commands. You can check the command ref to see. If it is FW to tear down the connection, it looks like the default timeout does not work. Therefore, I suggest you to use policy map to change the tcp timeout on FTP only.