ASA 5505 dmz nat problem

[lauri.ilves]

Hi,

I have a CentOS 5.7 VSFTP server behind of a Cisco ASA 5505 (dmz network) which is doing NAT. Clients outside the firewall cannot access the server with passive ftp.   They initiate a ftp session and as soon as the ftp client issues the  pasv command, their connection is dropped because my VSFTP server responds with the private ip (10.101.101.10) of the server, not the public ip. This behaviour is only with newer 8.3x and 8.4x bootimages, 8.2x is working fine and VSFTP responds allways with public ip!

Centos server has ip_conntrack_ftp kernel module loaded so it's working ok.

Here is 8.2x nat rule:

static (dmz,outside) 109.204.x.x 10.101.101.10 netmask 255.255.255.255

Here is 8.3x/8.4x nat rule:

object network dmz_ftpserver

host 10.101.101.10

nat (dmz,outside) static 109.204.x.x

Access rule:

access-list outside_access_in extended permit tcp any object dmz_ftpserver eq ftp

It doesn't make difference even if I open all ports (IP).

This passive ftp problem is really strange, because NAT is overall working right if I'm testing other protocols?!?

Can anyone help me please? I'm really stuck with this problem!

[lauri.ilves]

I solved problem myself, now it's working! I found Cisco document:

"Getting Started With Application Layer Protocol Inspection"

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/inspect_overview.html

I'm still wondering why I have to make these configurations with 8.3x and 8.4x bootimages? 8.2x and previous bootimages "worked out of the box", I haven't done these configurations ever before?

[varrao]

Can you tell me the config that you added???

Thanks,

Varun

[lauri.ilves]

class-map inspection_default

match default-inspection-traffic

class-map new_inspection

match access-list ftp_inspect

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

policy-map ftp

class class-default

  inspect ftp

!

service-policy global_policy global

service-policy ftp interface dmz

access-list ftp_inspect extended permit tcp any any eq ftp

I added also those other inspect definitions even though only "ftp" is necessary. Please read the configuration guide http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/inspect_overview.html