ACl for permittig ftp traffic

[goku-sun]

Given Host A with IP address 192.168.1.1/24 and FTP Server X with IP address 192.168.2.1/24 and a router is used to route between them. Now if we are to block all traffic except ftp between the two, can the following ACLs achieve that??

hostname router

int e0

ip access-group 101 in

access-list 101 permit tcp host 192.168.1.1 host 192.168.2.1 eq ftp

I know something is missing in the config and I am not sure how to cater for the "returning" traffic...

Would appreciate any inputs from you experts

TIA

goku sun

[Georg Pauwen]

Hello,

I think your access list has to look as following:

access-list 101 permit tcp host 192.168.1.1 host 192.168.2.1 eq ftp

access-list 101 permit tcp host 192.168.1.1 eq ftp host 192.168.2.1

Can you try this and see if it works ?

Regards,

GP

[goku-sun]

Thks for your advice GP.

As I don't have the equipment to verify and after some reading I found the port 20(ftp-data) is also opened during an FTP session.

So will it look like something below?

access-list 101 permit tcp host 192.168.1.1 host 192.168.2.1 eq ftp

access-list 101 permit tcp host 192.168.1.1 host 192.168.2.1 eq ftp-data

My another big query is that the above statements only cater for the direction from PC host to FTP server, so do we need to add extra ACLs to cater for some possible traffic for the opposite direction(say those for keeping the session alive)?

Many Thanks,

[mark-obrien]

That access list is correct.

Since your access list is only applied on the inbound interface, there is nothing restricting traffic in the opposite direction. Therefore, return traffic will be permitted.

Hope this helps.

Mark

[goku-sun]

Sorry if that sounds long-winded,, when you are saying "that access is correct", do you mean gpauwen's ACL or mine?

If you think gpauwen's is correct then I don't understand the statement"access-list 101 permit tcp host 192.168.1.1 eq ftp host 192.168.2.1" since the host should not use the ftp port when having FTP session.

Cheers.

[Harold Ritter]

You ACL is the correct one. You need to open ftp-data (TCP port 20) for your data session to work properly. ftp (port 21) is only for the control session.

Hope this helps,