Block traffic while allowing Passive FTP

[mromer]

We've got two subnets sitting behind a redundant pair of CSS 11050's. I need to block traffic between the two subnets (one contains our stuff, and the other contains stuff we're hosting for another company). I can use an ACL to do this, but it seems that any sort of ACL will prevent servers on either subnet from making outbound passive FTP connections.

Ref: "Understanding and Configuring FTP on the CSS 11000"

http://www.cisco.com/en/US/customer/products/hw/contnetw/ps789/products_tech_note09186a0080093de6.shtml

Each subnet is on a separate VLAN on the CSS, with a third VLAN for the uplink to the PIX firewall. All traffic between VLANs is bridged through the CSS--no one-arm setups.

Is there any way I can prevent communication between the two internal VLANs while allowing outbound passive FTP from each?

[mromer]

Looks like I panicked too soon. The problem appears to only come up if I NAT across the CSS. If I don't NAT, I can do outbound passive FTP and still keep the ACL in place.

[seilsz]

You can do this by using ACL's and Source Groups separately (i.e. - don't use an ACL to map traffic into a Source Group). Ex:

VLAN10 = 10.10.10.0/24

Services: VLAN10-1, VLAN10-2

VLAN11 = 10.10.11.0/24

Services: VLAN11-1, VLAN11-2

!--Write some ACL's to block traffic

acl 10

clause 5 deny any 10.10.10.0 255.255.255.0 destination 10.10.11.0 255.255.255.0

clause 10 permit any any destination any

apply circuit-(VLAN10)

acl 11

clause 5 deny any 10.10.11.0 255.255.255.0 destination 10.10.10.0 255.255.255.0

clause 10 permit any any destination any

apply circuit-(VLAN11)

!--Create some src groups to NAT outbound traffic

group VLAN10

vip address x.x.x.x

add service VLAN10-1

add service VLAN10-2

active

group VLAN11

vip address y.y.y.y

add service VLAN11-1

add service VLAN11-2

active

~Zach

[mromer]

Thank you. That's the last piece of the puzzle.

-Mark

[seilsz]

Hi Mark,

It also looks like the behavior described in the document you referenced (not being able to use an ACL to assign ftp pasv traffic to a src group) was the result of a bug (id CSCdv02486). This was fixed in the 04.01.046, 05.00.021 and 05.01.010 code trains.

~Zach

[mromer]

Well, that's interesting. I'm using 6.10.304 on the CSS.

Thanks again for your help.

-Mark