Showing results for 
Search instead for 
Did you mean: 

FTP through PIX


Hello all:

I am in the initial stages of setting up an FTP server in our network which will need to be accessible from the outside and through our PIX. Is there any tutorial or article that anyone knows about which could guide me through the PIX portion of it to ensure it has the right settings to allow connections through and data to be sent back to clients.



2 Replies 2

Rising star
Rising star

The common way to allow outsider/internet users to access your FTP server is via this method:

1. Map your internal FTP Server to a dedicated Public IP Address to enable internet users to access your FTP server.

You can either use dedicated public IP (preferred), or use PIX Outside interface IP with port re-direction.

2. Configure/add access-list (ACL) on the PIX Outside interface allowing any or specific external IP to access to your FTP server via its Public IP. T


Internal FTP Server IP:

Public IP:

a. Mapping internal FTP Server on Inside segment (same if it's in DMZ)

static (inside, outside) netmask

b. Create/add ACL & bind to Outside interface

access-list outside-access_in permit icmp any host --> allow PING to test FTPsvr reachability. Remove after the test.

access-list outside-access_in permit tcp any host eq 21

access-list outside-access_in deny ip any any

access-group outside-access_in in interface outside--> bind ACL to Outside interface

* Make sure your PIX set the default route correctly to the Internet router

The return traffic back to clients normally has no issue with PIX as it'll keep the connection/session status in its state table.

You can test the reachability/connectivity between client and server using the above ping (ICMP) test.

PIX's doc on allowing inbound connection:




I would add one note to this:

Make sure that application inspection is enabled for FTP.

The command will be: "fixup protocol ftp 21" if you are using PIX OS 6.X.X ( and will be "inspect ftp" if you are using PIX OS 7.X.X (

This will be needed to make sure that your PIX will allow both Active and passive FTP.

Hope this helps.


Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers