I'm wonderng if anyone can help with this problem.
I have my PIX configured beautifully.
It runs my FTP file server with PASV connections.
But when I set the server to allow SSL connections only - the clients (cute ftp/flash ftp etc) trying to connect fails!
Interestingly - when I set the server to accept normal and SSL connections. The client initally connects using a normal (un-SSL) connection, then once authentication is confirmed the server then transfers the files using SSL encryption.
This type of connection is considered to be a Explicit SSL connection.
What i'm after is an Implicit connection.
What's the difference? Well when a client connections using an Implicit connection the initial connection and subsequent file transfer are all encrypted.
The real problem I have is that when I set my server to accept only Implicit SSL connections as I want 100% encrpytion - the PIX doesn't seem to be able to make the connection.
I have been wondering if it is because of the NAT routing system that I have set up for my SOHO network?
The reason I say that is because if an encrpyted message (username/password) arrives at the PIX - the PIX cannot understand it! If the PIX cannot understand it - then the PIX does not know where to send it to be read (i.e. the FTP file server on the internal network)
My problem is when I set the server to allow normal and SSL connections (server = Serv-U) I am unable to force people to use an encrpyted connection. They can still connect using a normal connection. Which is why I would like to be able to force users to connect wth an encrypted connection.
If it's not possible to do this with the PIX - I would also be interested in anyone who has found a way around this. Maybe by utilising SSH connections etc.
Any thoughts?
