Asa 5510. FTPS Explicit client fails at Init TLS stage

[Guillermo Vitas]

Hello.

I have a problem when trying to access from a workstation on the internal network to an external FTP server using Explicit FTPS. After the server requires the client TLS Authentication the client inits TLS but the connection is closed by timeout.

I have disabled the FTP inspection on the firewall and I have opened some high ports from the Internet to the test workstation (ACL and NAT rules), but without results.

If I try to connect from a workstation to the FTP server using a direct Internet connection I can access the FTP server without problems, so I think the problem is in the ASA.

Some idea on how to solve the problem?

Regards

[jocamare]

Is the client working on passive or active mode?.

In case this is working on active mode, can you confirm that the client supports the CCC [clear channel command] command?

In case this is working on passive mode, it should work just fine.

[Guillermo Vitas]

Hi.

Thanks for your response.

It fails on both modes. The fail is On a stage previus authentication and mode selection I think.

You can see the error at the image i attach. The image is froma a Wireshark capture.

Regards.

[jocamare]

Was this captured using passive or active mode? Let's try to use passive when testing.

Captures are useful, would it be possible for you to upload the actual capture?

Port 21 is used for the Control Connection and then uses the Data connection.

From the captures we can see that the three way handshake is is successfully established and the client sends a AUTH TLS request.

The server then responds back with a message 234 and is okay for the encryption mechanism.

After that the client also sends an encrypted response message, the server replies with aparently just an ackownledgement for none of the packets that were captured.

Have you tried to connect after removing the FTP inspection on the ASA?

[Guillermo Vitas]

Hi Jocamare.

Thanks for your response.

The capture I sent was taken after disabling FTP inspection. I am not sure if using passive or active mode, I think was taken using passive mode. I will double check this and recapture traffic asap.

regards.

[Guillermo Vitas]

Hello.

Sorry by the huge delay on the response.

I have checked if client is in Passive or Active Mode. But on the client i can see the error before it enters in acttive or  passive mode.

The error arises on the credential interchange I think. But credentials are ok.

Any idea?

Regards

[jocamare]

Can you provide the configuration of the ASA and a packet capture of this traffic?

This looks like the server/client was not able to validate the certificate.

Can you confirm that they have the certs installed?