Downloading IOS via FTP through ASA5512 not working

[abideen.shaikh]

Hi All,

I am trying to download IOS image in to ASA firewall . There is a OOB ASA firewall connection is traversing through to the FTP server.

When I am running a capture on the OOB ASA getting below captures

480: 12:30:05.219059 802.1Q vlan#xx8 P0 xx.xx.xx.35.5296 > xx.xx.xx.135.21: S 2607808118:2607808118(0) win 32768 <mss 1460,nop,nop,timestamp 3600727312 0>
482: 12:30:08.248293 802.1Q vlan#xx8 P0 xx.xx.xx.35.5296 > xx.xx.xx.135.21: S 2607808118:2607808118(0) win 32768 <mss 1460,nop,nop,timestamp 3600730343 0>
483: 12:30:14.267655 802.1Q vlan#xx8 P0 xx.xx.xx.35.5296 > xx.xx.xx.135.21: S 2607808118:2607808118(0) win 32768 <mss 1460,nop,nop,timestamp 3600736366 0>

I have policies in place on the OOB firewall and packet tracer is simulating allow as well.

I am able to ping the FTP server. From FTP server i can SSH to the device.

Please help me in troubleshooting this issue further.

xx.xx.xx.135 is the FTP server
xx.xx.xx.35 is the Firewall from where I am trying to download ios.

Below is the output from packet tracer.

input-interface: oob
input-status: up
input-line-status: up
output-interface: dcmgmt
output-status: up
output-line-status: up
Action: allow

Connection is getting out of the firewall hitting OOB firewall but seems like never leaving OOB firewall can not see any hits on the FTP server after running the wireshark.

Regards 

[MHM Cisco World]

FTP need inspection to allow pass ASA, are you config inspection FTP ?

[abideen.shaikh]

Hi,

On the source ASA and on the OOB ASA on both of them below is enabled .

ftp mode passive 

policy-map global_policy
class inspection_default

inspect ftp

[balaji.bandi]

how does your network looks like as you mentioned

ASA ---(another FW) --FTP ?

[abideen.shaikh]

Source ASA (xx.xx.xx.35) --- OOB ASA (xx.xx.xx.20)--- FTP (xx.xx.xx.135).

Thats correct 

[MHM Cisco World]

according to your network you need to port forwarding in OOB ASA for FTP port.
otherwise the OOB will change the por.t if there is dynamic NAT.

[abideen.shaikh]

Thanks for sharing could you please share the command so ill try configuring port forwarding.

[MHM Cisco World]

https://www.petenetlive.com/KB/Article/0000772

[balaji.bandi]

easy method, Grab a USB stick and connect to ASA, (since this is one time requirement).

[abideen.shaikh]

Hey Balaji this is not one time there are several ASAs connected this way if we manage to get this one working then we can draft a procedure to upgrade all the ASAs as and when required.

[abideen.shaikh]

Is there a way to establish it is not being dropped the OOB or source firewall itself.  I have shared a capture in the initial message.