FTP not working when ACL is applied on outside interface

[mahesh18]

Hi Everyone,

I am trying to FTP  from the PC  behind the DMZ  interface.

I have config the ACL to allow FTP from outside interface direction is outside.

I can make the FTP work by config of ACL on the DMZ interface but i want to test it so that it can work from my PC behind DMZ interface when i apply ACL on the  outside interface direction is out.

I have attached the asa config.

Need to know if there is any way under current config that FTP can work without applying ACL to DMZ interface?

[Karsten Iwen · Accepted solution]

I can't look at your config at the moment (doesn't work on the iPad), but one alternative to an ACL on the DMZ interface could be to use a global ACL.


Sent from Cisco Technical Support iPad App

[pankaj29in]

Hi Mahesh,

Apply that acl in incoming direction on outside interface.

Cheers

Pankaj

[Karsten Iwen · Accepted solution]

Apply that acl in incoming direction on outside interface.

no, the ASA is a statefull Firewall with FTP-Inspection. You never need an incoming ACL in the outside interface for outbound FTP when you have a proper config.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[mahesh18]

Hi Karsten,

Your answers are good to read and they  have so much knowledge.

For time being i allowed ftp to any destination from DMZ  but on outbound interface direction out  i have restricted it with

certain IP  which are allowed.

Best regards

Mahesh