ACL allowing internal clients access to outside FTP data on cisco 3750

[iosepmonica]

Hi,

I have this ACL on a cisco 3750 for allowing internal clients to access outside  FTP  servers, and I am concerned about the security hole that the last statement it might create:

access-list 111 permit tcp 10.100.111.0 0.0.0.255 gt 1023 any eq ftp

access-list 111 permit tcp 10.100.111.0 0.0.0.255 gt 1023 any eq ftp-data

access-list 111 permit tcp 10.100.111.0 0.0.0.255 gt 1023 any gt 1023

This is the only way I could get internal clients to access FTP data outside  the network/Internet.

The access-list is applied inbound on the VLAN interface on the 3750.

Will this expose clients to a security risk?

Thank you.

[Julio Carvajal]

Hello,

So this is applied on the internal interface right??

What FTP mode are you running, if it's passive where the client innitiates both connectionns Control and data channel then you must have it like that... I mean it will not expose as this is traffic from your clients to the outside, not from outside to inside.. You follow me

Why don't you restrict traffic on the interface that is next to the outside world?

Regards,

[iosepmonica]

Correct, this is applied on the internal interface, and it is for internal clients accessing FTP servers on the Internet mostly.

In a typical environment, I would do this on a firewall, but in this particular case, this client wants it on the internal L3 switch. This switch has an interface that connects to a gateway for Internet access.

No connections initiated from outside to the internal clients are allowed at all, and the traffic going to the Internet only includes FTP, NTP and DNS.

[Julio Carvajal · Accepted solution]

Hello,

Yes, so that would be the only way to make it happen as you will need some sort of inspection in order to open the right pinholes for the outgoing Data channel,

but if everything for out to in is being denied you should be good to go

Regards,

Remember to rate all of the helpful posts

Julio Carvajal Segura

[iosepmonica]

Thank you very much!

[Julio Carvajal]

Hello,

Hey man my pleasure,

Remember to rate all of the helpful posts and can you mark the question as answered?

Regards