topic Passive FTP assistance in Network Security

Passive FTP assistance

cisco24x7 — Mon, 11 Mar 2019 12:21:18 GMT

Linux_FTP_Server---(i)Pix(o)----Linux_FTP_Client

Pix is running version 7.2(2)

FTP_Server: 192.168.1.2/24

Pix inside: 192.168.1.1/24

Pix outside: 1.1.1.1/24

FTP_client: 1.1.1.10/24

static (inside,outside) 1.1.1.2 192.168.1.2 netmask 255.255.255.255

access-list External permit icmp any host 1.1.1.2 log

access-list External permit tcp any host 1.1.1.2 eq 21 log

access-group External in interface outside

Is it possible to allow ONLY passive FTP through the firewall? In other words,

FTP_client can only do passive ftp with the

server. Active FTP will be rejected by the

firewall.

If it is possible, how does one go about

doing it?

Thanks.

cisco24x7 — Tue, 25 Mar 2008 21:16:17 GMT

Anyone know the work-around on the firewall

for this? Thanks.

gbudd12345 — Thu, 27 Mar 2008 16:02:03 GMT

If you remove the FTP inspection and opened access to your server on port 21 and 20...it might prevent passive FTP

--Gavin Budd

cisco24x7 — Thu, 27 Mar 2008 19:32:09 GMT

Have you tried it and that it works for you?

CCIE Security