PIX 525 fails to allow SSL over FTP

[jmcaden]

We have a PIX 525 running Ver 6.1(4) with three interfaces, one Inside, one DMZ, and the Outside. We installed a FTP server on the DMZ, and want to run FTP with SSL. The FTP programs run from the Inside, but fail from the Outside. The FTP server can authenticate to an inside Active Directory server. The failure is from the Outside when encryption is turned on. The client is authenticated but does not get to a directory listing. The hole from the Outside:

static (dmz3,outside) 192.168.180.13 172.30.7.13 netmask 255.255.255.255 0 0

conduit permit tcp host 192.168.180.13 eq ftp any

Should this work? Or is there some basic reason it fails?

[abertram]

You should be alright as the pix would not be affecting the SFTP directory listing. Most likely this has to do with the FTP server trying to use PASV or the client. Common problems with running FTP servers behind a firewall regardless of brand. Have you modified settings on the client and server with regards to passive/PASV mode?

Also I usually suggest getting rid of the conduit statements by replacing them with ACL's as conduits are legacy mechanisms that are soon to be unavailable in the command set.

access-list 100 permit tcp any host 192.168.180.13 eq ftp

Should do the trick.

Hope this gives you some places to look regarding your ftp problem.

[stan_lee_br]

Try doing a "no fixup ftp". The PIX is probably doing deep packet inspection, and can't understand the SSL tunnel.