08-10-2011 09:53 AM - edited 03-11-2019 02:09 PM
***This is the 2nd instance of this post. I had to post it again, as I had inadvertently hit "ANSWERED" on the original post. The question is still "NOT ANSWERED".
Here is the original post...
I have a very interesting problem at a client site this morning. Here is a summary of the problem in a nutshell.
This specific client has set up FTP to an FTP server in a DMZ at their Headquarters building. They have two Production servers that send FTP data to the box in the DMZ. The 1st of the two servers sending FTP data is located on the inside network (they use an ASA with a inside, outside, DMZ, WAN) and sends the FTP data into the box on the DMZ.
The 2nd of the two production servers is located across the WAN interface of the ASA.
The issue is as follows: Server 1 can perform all of its ftp commands correctly once it has connected to the FTP server in the DMZ. Server 2 can log into the FTP server and authenticate successfully, but when a "ls" command or and "dir" command is issued, there is no response (the contents of the root folder are not listed as they are when the same command is issued on the 1st server).
I have been running sniffer on the FTP server in the DMZ, but cannot tell from the traces what is wrong. I have a hard time beleiving that this may be an ACL issue, as if FTP was not allowed coming in from the WAN interface, then they would not have the ability to authenticate.
I am wondering if anyone has seen behavior like this before...
Thanks for any help or insight.
Kevin
Solved! Go to Solution.
08-11-2011 06:05 AM
Seems to be a active/passive FTP mode issue change the mode and try.
thanks
ajay
08-10-2011 11:43 AM
Is FTP inpsection enabled? If so, you might try turning that off.
Is ftp mode passive enabled? If so, you might try changing that to ftp mode active.
Just a couple of quick and easy ideas to try. Hope it helps.
08-10-2011 11:46 AM
conversely, if you don't have FTP Inspection enabled, turn it on and see what happens.
08-10-2011 01:05 PM
Well I was able to take the inspect FTP out of the policy map global. Unfortunantly this had no bearing on resolving the issue. We are still able to log into the ftp server from the Production Server on the other side of the WAN interface, but cannot do an ls or a dir command.
Thanks for the response anyhow.
08-11-2011 06:05 AM
Seems to be a active/passive FTP mode issue change the mode and try.
thanks
ajay
08-11-2011 11:42 AM
Actually it did seem to be the differnece betweent the two. I found an article and ended up opening ephemeral ports and that allowed the connection to occur.
thx
08-11-2011 07:35 PM
Try to allow all port between WAN to DMZ FTP server IP address...in acl..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide