topic Re: FTP coonection reset issue in Network Security

FTP coonection reset issue

ray_stone — Mon, 11 Mar 2019 14:02:07 GMT

I have been experiencing FTP connection reset issue while uploading files.

I have reviewed the logs and found log 305005:

3|Oct 24 2008|02:23:51|305005|*.*.4.41|3983|||No translation group found for tcp src inside:*.*.71.252/4708 dst dmz:65.205.4.41/3983

Can anyone help me out what should i do to fix this issue ASAP.

Re: FTP coonection reset issue

kerek — Fri, 24 Oct 2008 10:31:38 GMT

Hi,

Seems to be a NAT problem.

Can you post the config and let me know from where you try to connect and to where?

Thanks,

Krisztian

Re: FTP coonection reset issue

ray_stone — Fri, 24 Oct 2008 12:11:17 GMT

Hi,

To do trobleshoot, I captured the packets on DMZ interface and found Spoofing Attack from Inside Network and whatever the connection is made on outside to DMZ for FTP access, the same connection is also making from Inside to DMZ Network and while it makes the connection then FW reset all connection.

Exp :

Outside Machine : 1.1.1.1

DMZ FTP Server : 2.2.2.2

Inside Network : 192.168.10.0/24

The connection between 1.1.1.1 and 2.2.2.2 is created and its working fine but when the same connection makes on Inside Interface which is already made on DMZ Interface then the FW reset the all connections and the geniune connections also gets denied.

Please Advice how to resolve this issue as I have checked through Sniffer on Inside host and found nothing any unwanted things.

Re: FTP coonection reset issue

kerek — Fri, 24 Oct 2008 12:31:42 GMT

Hi,

Can you post the config?

Krisztian

Re: FTP coonection reset issue

ray_stone — Fri, 24 Oct 2008 17:40:54 GMT

The Conf file is attached.

When i try to upload any files on ftp server (#.#.4.41) then it works fine for 5 to 10 minutes after that connection gets lost. When i try to download anything again it works again for couple of minutes and connection gets reset.

Log : 3 Oct 24 2008 14:58:16 305005 #.#.4.41 4882 No translation group found for tcp src inside:123.236.38.235/2288 dst outside:#.#.4.41/4882 Please Advice

123.236.38.235 its a my home public IP and the connection was eastlablished with FTP Server #.#.4.41 which is placed in DMZ Zone but look at the above log which shows the Src is in Inside.

Re: FTP coonection reset issue

ray_stone — Fri, 24 Oct 2008 17:43:36 GMT

It look like as an attack (Spoof) but dont able to understand how to find out the root cause. Please share your experience. Thanks!!

Re: FTP coonection reset issue

ray_stone — Sat, 25 Oct 2008 01:45:41 GMT

Can anyone advice on this. Thanks

Re: FTP coonection reset issue

kerek — Mon, 27 Oct 2008 08:51:41 GMT

Hi,

In your first post you mentioned ftp, but the ports are not really ftp ports (unless u use passive ftp).

I don't really understand how the traffic which is coming through the outside is seen as inside.

Krisztian

Re: FTP coonection reset issue

kerek — Mon, 27 Oct 2008 09:04:46 GMT

Hi,

The other problem can cause problems is using a translated IP which actually resides on the Outside i.e. static (dmz,Inside) #.#.4.41 192.168.200.11 netmask 255.255.255.255 dns

I have tried out similar mapping on my ASA and got 'portmap translation creation failed'.

Try to use something different IP (or not translate at all).

Hope it helps,

Krisztian

Re: FTP coonection reset issue

ray_stone — Mon, 27 Oct 2008 13:58:14 GMT

I have delteted that entry but still getting same error message and it's resetting the connections too. After removing that entry I have done reload the FW but still getting same error. Pl. help.

Re: FTP coonection reset issue

kerek — Mon, 27 Oct 2008 14:25:10 GMT

Hi,

Can you do from cli:

show log | inc 65.205.4.41

just to see what's happening?

Can you also post the output of 'show xlate'

Krisztian