CSS and non standard ftp port

[clayton-price]

We have an ftp server running on port 10021. Is there a way to have the CSS translate the IP in the payload when not using port 21? On an IOS router one can use the ip nat service command. I have not seen anything like this on the CSS.

We currently have a VIP and a sourcegroup with matching IP's configured for the ftp server.

Thanks!

[kevin.graham]

You'll need to move the FTP server to a standard port for now. See CSCeb22950.

[Gilles Dufour]

Kevin, this bug applies to CSM - not CSS.

Gilles.

[Gilles Dufour · Accepted solution]

Clayton,

try to use the command 'application ftp' in the content rule definition.

Regards,

Gilles.

[clayton-price]

That seemed to resolve the fact that the address in the ftp payload was not being translated. However....Our ftp server is configured to tell clients to connect on ports 8550-8650. It seems that the content switch is passing a port outside this range back to the client. The CSS then maps the port it sent to the client to a port in the range of 8550-8650. Is there a way to have the CSS pass the port specified by the server?

Thanks!

Clayton

[Gilles Dufour]

Clayton,

this is normal behavior.

CSS changes TCP ports.

There is no way to prevent this.

Gilles.

[jnorman]

Configure your VIP for port 21 traffic and the service for port 10021.

service HP17_5001

ip address 10.254.236.7

protocol tcp

port 10051

active

content DDN1

vip address 192.67.251.15

port 21

protocol tcp

add service HP17_5001

application ftp-control

active

Hope ths helps.

[clayton-price]

I appreciate all the responses! In this case the CSS is also translating the high order port the server informs clients to connect to.

I'm likely going to configure a port 21 VIP in addition to the port 10021 VIP in order to get around some other firewall issues.