01-10-2011 01:34 PM - edited 03-11-2019 12:33 PM
hi,
i have a problem with an ASA and connect from outside to an inside ftp server. The connection stuck at Opening data connection....
[R] 227 Entering Passive Mode (<external ip>,198,49).
[R] Opening data connection IP: <external ip> PORT: 50737
[R] QUIT
[R] 221 Have a nice day.
[R] Logged off: <external ip>
I have configured an ACL for FTP and FTP-DATA and activate inspect rule.
Any suggestions?
Thanks and regards
Jason
01-12-2011 07:26 PM
Here is the link for the syslog that you are seeing:
http://www.cisco.com/en/US/docs/security/asa/asa82/system/message/logmsgs.html#wp4773005
I believe you are running into a known issue:
what code are you running on this ASA?
Post the output of
sh run policy-map
sh run service-policy
sh service-policy flow tcp host 172.16.9.10 host external ftp server eq 21
-KS
01-13-2011 02:21 AM
I`m running ASA 8.3(1)
sh run policy:
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect pptp
inspect icmp error
inspect dns
inspect ftp
!
sh run service-policy
service-policy global_policy global
sh service-policy flow tcp host 172.16.9.10 host external ftp server eq 21
Global policy:
Service-policy: global_policy
Class-map: inspection_default
Match: default-inspection-traffic
Action:
Input flow: inspect ftp
Class-map: class-default
Match: any
Action:
01-16-2011 04:25 PM
Hello,
Sorry. I just saw the config that you sent over.
You are using global access-list as well as interface acl. Auto nat and manual nat. Object-groups in the global ACL. It makes it very hard to read the config. Being on the box makes our life a lot easier.
Inside Host: 192.168.x.10 - outbound breaks - inbound works - I don't see a translation for it. Not sure how inbound works.
Vlan 106 Host:172.16.6.10 - outbound breaks - inbound breaks (sub-interface)
Vlan 109 Host:172.16.9.10 - outbound breaks - inbound works (sub-interface)
You did all the above tests with filezilla?
The configuration looks correct. Like I mentioned previously this will be a very involved troubleshooting.
If you do not have smartnet, I suggest purchasing a single case. It is worth it.
This is a good reason why should purchase smartnet.
We would have to spend a few hours on the box. Gathering all what I had mentioned before.
-KS
01-18-2011 11:31 AM
Ok, What is best practice? Only acl configs on global or better on the interface? The same for NAT. I mean i test some things and some times it works with auto nat and sometimes with manual nat that why i use both.
01-24-2011 01:55 AM
Hi Sankar,
I dont know if you are able to assist as i am having a similar issue.
I had issues in the past connecting to external ftp sites so i created an inspection rule on my wan interfaces and ask any staff trying to connect to any ftp site to send me the ip address so i can add under the inspection rule and this has always worked for me.
I had to do this because we also have ftp sites internally that people try to connect to from outside too.
But lately ,i have done this for an external ftp site and it connects but doesnt list directories.
The log message is
terminated by inspection engine,reason -inspector drop reset.
Below is the internal host trying to connect to the ftp server service policy command output :
External ftp server is 81.144.145.6.
# sh service-policy flow tcp host x.x.x.x host 81.144.145.6 eq ftp
Global policy:
Service-policy: global_policy
Class-map: cmap
Match: access-list TCP
Access rule: permit tcp any any
Action:
Input flow: set connection advanced-options tmap
Class-map: netflow-export-class
Match: access-list netflow-export
Access rule: permit ip any any
Action:
Output flow: flow-export event-type all destination 10.120.3.226 10.120 .16.220
Class-map: class-default
Match: any
Action:
Output flow:
Interface MAN_CORE_TO_WAN:
Service-policy: STV_IPS_POLICY
Class-map: STV_IPS_CLASS
Match: access-list STV_IPS_ACL
Access rule: permit ip any host 81.144.145.6
Match: default-inspection-traffic
Action:
Input flow: inspect ftp
Class-map: class-default
Match: any
Action:
Output flow:
Interface MAN_CORE_TO_WAN_ELXSI:
Service-policy: STV_IPS_POLICY
Class-map: STV_IPS_CLASS
Match: access-list STV_IPS_ACL
Access rule: permit ip any host 81.144.145.6
Match: default-inspection-traffic
Action:
Input flow: inspect ftp
Class-map: class-default
Match: any
Action:
Output flow:
Interface MAN_CORE-TO-WAN-THUS:
Service-policy: STV_IPS_POLICY
Class-map: STV_IPS_CLASS
Match: access-list STV_IPS_ACL
Access rule: permit ip any host 81.144.145.6
Match: default-inspection-traffic
Action:
Input flow: inspect ftp
Class-map: class-default
Match: any
Action:
I just cant understand why it has worked for tens of external ftp sites and it doesnt work for this particular one.
Cheers
01-24-2011 03:02 AM
Hmm...the flow does go through the inspection and the inspection doesn't seem to like something in the packet. Without looking at captures ingress to egress it is hard to say why ftp inspection doesn't like something within the packets.
See if you can translate the source to look like some other IP address and see if can reach the ftp server on the outside and list directories.
Besides that, best option is to open a TAC case as this troubleshooting will be a very involved one.
-KS
01-24-2011 06:29 AM
Thanks KS,
Sorted it by just changing the Transfer mode on Filezilla ftp client to Active and i can now list directories.
Regards.
02-11-2014 08:09 AM
I had the same issue, and likewise mine worked in active mode. Since it is preferable to have it in passive mode, here is what I found fixed my problem. This is only applicable to FTP servers behind NAT on a firewall that supports FTP inspection.
1. Verify that port tcp 20 & tcp 21 are NATd to server and access list allows them.
2. Verify FTP inspection is running with default inspection map
3. Verify settings on FTP server are configured for a specific custom port range (I used 50000-51000, but you don't usually need any more than # of clients x 2). With inspection enabled, these do NOT need to have NAT rules forwarding them to the server.
4. The "External Server IP Address for passive mode transfers" should be manually set to the INTERNAL IP address of the server. Not the external address you are translating from. This is due to the way that connection information is handled within the packets for a FTP session.
This is verified to work with Filezilla version 0.9.41 Beta
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide