ASA5506 drops some files in passive FTP

[Yura Kazakevich]

Hi everyone,

Very strange issue with FTP inspection on Cisco ASA5506-X (9.8(2)20). Passive mode works fine, BUT not for all files...

For example (look at screenshot), user can download any file (txt) except this one 34313622.210.

As you can see at screenshot, size of downloaded file 34313622.210 is incorrect.

In Passive mode all other files can be downloaded without problems. The same issue from time to time apears for others users in different folders. I've checked these files - simple txt files. I can open them without problems on FTP server (Filezilla FTP 0.9.55) for reading or editing.

If I try download the "incorect" file (34313622.210) in Active mode - everything works fine! The issue persists in Passive mode ONLY.

When connection drops in PASV mode I see count of droped packets is growing in ASA. Invalid EPSV format drop grows as well:

Could somebody tell me how to solve it?

My configuration is pretty simple. I did it using this guide.

[Dennis Mink · Accepted solution]

i suggest you raise this with TAC , based on  

https://quickview.cloudapps.cisco.com/quickview/bug/CSCso23893

even though you are not running this version. Also test with ftp inspection turned off

[Yura Kazakevich]

I turned off inspection FTP and it helped. Passive mode is working properly now - no problems with files anymore.
Thank you!

[Ilkin]

Is this an IPv4 or IPv6 connection?

[Yura Kazakevich]

This is IPv4 connection.

[Yura Kazakevich]

Hi Ilkin,
Can you help? What info I need provide in order to solve issue?