How to achieve traffic policing against passive-mode FTP using ASA5500?

[jgonzalez79]

Hi,

I'm experimenting with policing FTP traffic from outside interface to inside ftp clients on an ASA5510. I am able to police active-ftp connections by using ACLs which monitor port 20 & 21 and then using MPF. This is easy enough. Passive-ftp is proving to not be as easy to police. On this post the solution was to hard code the passive ports used in the ftp client: https://supportforums.cisco.com/message/862329#862329. I would rather not use this approach as it won’t be known who will be doing transfers at any one time.

On the ASA5500 series is there a way to achieve passive-ftp policing "dynamically"?

Thanks

Joel

[varrao · Accepted solution]

Hi Joel,

There is no feature in ASA, which can automatically police the dynamically changing ports in passive FTP, however just a few tweaks like:

++ Either apply policing on the entire ip range

++ Or you can match the entire port range to police:

hostname(config)# class-map FTP-DATA
hostname(config-cmap)# match port tcp range 1024 65535

You can also tie the ports if you have settings on your FTP server to
restrict the port usage to a certain pool. If you can do that, then you can
apply policing to those certain ports only.


Otherwise there are no other options to do it.

Hope this helps,

Thanks,
Varun 
 

[jgonzalez79]

Hi Varun,

Thank you for the speedy reply. At least now I know I'm not blind as I've been looking all over for an answer to this question!

Joel

[varrao]

Great I was able to answer your query

-Varun