i configured port redirection on ASA to allow external user access to Internal FTPS Server. but it's not working
i use Filezilla client to access but i have this error.
Statut : Connexion à x.x.x.x:21...
Statut : Connexion établie, attente du message d'accueil...
Réponse : 220-Microsoft FTP Service
Réponse : 220 FTP-Server FTP
Commande : AUTH TLS
Réponse : 234 AUTH command ok. Expecting TLS Negotiation.
Statut : Initialisation de TLS...
Erreur : Délai d'attente expiré
Erreur : Impossible d'établir une connexion au serveur
please can somebody know what can cause this issue ?
thanks for your help
Is this FTPS server working on active mode?
Can you share the nat configuration for the server?
ASA is configured in Passive Mode.
this is NAT configuration
static (DMZ1,outside) tcp interface 20 'ftps-server-private IP' 20
static (DMZ1,outside) tcp interface 21 'ftps-server-private IP' 21
access-list outside_access_in extended permit tcp any host 'Outside_public_IP' eq 20
access-list outside_access_in extended permit tcp any host 'Outside_public_IP' eq 21
Here is a document that you will need to read
As you can see you will be using FTPS (FTP over SSL) that uses port 990 for the control channel (this information is encrypted) and the data channel goes on plain text.
Is there a way you can use a static one to one and then allow port 990 on the outside ACL?
FTPS is not supported in the ASA.
Due to the problem of traffic beeing encrypted.
However you can in some FTPS servers setup that you are only able to use some few ports.
Then you can open for all those ports that you have choosen.
If you want a better alternative than FTPS use SFTP.
FTPS is firewall unfriendly
SFTP is firewall friendly
SFTP will work correctly all the time.