Hi,
There are two modes of FTP operation, Active & Passive. Active utilizes port 21 for session initiation and 20 on the reply which can be handled easily by ASA with default command " inspect ftp". Passive mode works differently and uses non-standard ports after the session initiation:
Here's how passive mode works in a nutshell:
The client connects from a random port to port 21 on the server and issues the PASV command. The server replies, indicating which (random) port it has opened for data transfer.
The client connects from another random port to the random port specified in the server's response. Once connection is established, data transfers are made through these client and server ports.
To handle this, you need to capture the port or range of ports used in your FTP connection then you need to allow it as mentioned in the below steps:
-
access-list ftp-list extended permit tcp any any eq XXXX
or
access-list ftp-list extended permit tcp any any gt 1000
!
class-map ftp-class
match access-list ftp-list
!
policy-map global_policy
class ftp-class
inspect ftp
!
you can refer to below document which further explain how to capture the ports. Usually these ports utilize higher number ports greater than 1000
https://www.cisco.com/c/en/us/support/docs/content-networking/file-transfer-protocol-ftp/200194-ASA-9-x-Configure-FTP-TFTP-Services.html#anc10
