topic acl on 2851 router in Network Security

acl on 2851 router

bsudol79p — Mon, 11 Mar 2019 11:24:55 GMT

Hi have problems with my ACL, I cannot get passive ftp to work. I can log in but I cannot see any folders inside the FTP site. In active mode there is no problem. The interface has static translation for the FTP server. Here is the ACL. Can anyone help? Thanks

access-list 112 permit tcp any host x.x.x.x eq ftp

access-list 112 permit tcp any host x.x.x.x eq ftp-data

access-list 112 permit tcp any eq ftp-data host x.x.x.x gt 1024

Re: acl on 2851 router

whisperwind — Fri, 12 Oct 2007 19:41:26 GMT

do you have the acl applied in the right direction ?

Re: acl on 2851 router

bsudol79p — Fri, 12 Oct 2007 20:17:56 GMT

Yes the ACL is applied correctly because the FTP works when it is in active mode, but it doesn't work when it is in the passive mode.

Re: acl on 2851 router

saro — Fri, 12 Oct 2007 21:56:10 GMT

Your access-list is wrong. Here is the way things work with Active:

control channel

client:>1024 --> server:21

data channel

server:20 --> client:>1024

The active scenerio you have covered...

But passive works like this:

control channel

client:>1024 --> server:21

data channel

client:>1024 --> server:>1024

The data channel is negotiated... no port port 20 (if i remember correctly). To make this work for both active and passive, your acl has to read:

access-list 112 permit tcp any host x.x.x.x eq ftp

access-list 112 remark FOR ACTIVE

access-list 112 permit tcp any eq ftp-data host x.x.x.x gt 1024

access-list 112 remark FOR PASSIVE

access-list 112 permit tcp any gt 1024 host x.x.x.x gt 1024

Re: acl on 2851 router

bsudol79p — Mon, 15 Oct 2007 14:30:20 GMT

It works, Thanks for all the help!!!!!!!!!!