05-22-2020 01:42 AM - edited 05-22-2020 02:50 AM
Hi,
I am having issues to make work a passive FTP server with explicit TLS encryption because ASA is blocking the response on a random port, even when I have enabled this configuration:
access-list ftp-list extended permit tcp any any gt 1000
!
class-map ftp-class
match access-list ftp-list
!
policy-map global_policy
class ftp-class
inspect ftp
Problem is that we are using explicit ftp with TLS encryption and this is probably the reason because the ASA is not able to inspect that traffic and block the connection. Do you know if there is a solution for this? Thanks!
05-22-2020 01:09 PM
passitve FTP with TLS you required 1 to 1023 ports - try that and let us know.
your ACL show > 1000
05-25-2020 01:16 AM
I am seeing connection attempts to the ports 40XXX-6XXXX. Anyway, if traffic is encrypted, how the ASA could inspect it? Thanks!
05-29-2020 10:06 AM
You're right the encryption will stop the ASA from seeing the packet and therefore won't be able to dynamically open the ports. The passive FTP port range is configured on the server so you could contact whoever manages that, otherwise they tend to be within 49152-65535. FTP isn't a nice protocol for security.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide