allow FTP site

[1salvarez]

Noob here. I want to allow an ftp site for our users. I know how to do it via ASDM but have been wanting to use CLI.Looked online but haven't been able to find what i'm looking for.

[Federico Coto Fajardo · Accepted solution]

Hi,

To allow FTP traffic you need a static NAT rule to allow access to the FTP server and an ACL allowing the ports.

i.e.

Let's say your internal FTP is 10.1.1.1 and the public IP will be 200.1.1.1

So, you requiere a static translation rule (ASDM or CLI) and an ACL permitting FTP from any source to the public IP.

If you want to do it via CLI you can post the following:

sh run static

sh run access-group

sh run access-list NAME   --> change NAME for the name of the ACL applied to the outside interface

Federico.

[1salvarez]

Thanx

[Federico Coto Fajardo]

What is the IP of the FTP server behind the ASA?

Adding to the list you will need:

static (in,out) tcp PUBLIC_IP 21 PRIVATE_IP 21

access-list outside_access_in permit tcp any host PUBLIC_IP eq 21

Federico.

[1salvarez]

We dont have FTP server. This is for ftp sites that we need to access

. For example thru ASDM to allow acces to an FTP site I would go to Configuration>Firewall>Objects>Network Objects/Groups> and I'll add the IP and name.

See attached.

[Federico Coto Fajardo]

If it's to allow outbound FTP access to an external server, you should add the IP of the server to the object-group.

If from an internal computer you try to connect to this new FTP server what happen?

Can you reach it via telnet x.x.x.x 2?

Federico.

[cadet alain · Accepted solution]

hi,

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/objectgroups.html

[1salvarez]

Thanx for your help guys. That doc looks like what

I am looking for.