ACL-FTP

[dkblee]

hi! I posted this question before in this forum, i thought it work, but it didn't, sorry about that, have to post it another time.

What i'm trying to do is to enable ftp access from host A(router1) to host B(router 2) and block all other traffic except ftp. All traffic from host B (router 2) to host A (router 1) should be blocked.

I tried the access-list below on router1(outbound):

access-list 101 permit tcp host 192.168.10.10 host 192.168.20.10 eq 21

access-list 101 permit tcp host 192.168.20.10 eq 20 host 192.168.10.10

i got the access-list sample from cisco website.

In addition to this i've tried to add another access-list below on the inbound

access-list 102 permit tcp host 192.168.20.10 host 192.168.10.10 established.

By applying these access-lists on router1 fa0/1 (ACL 102 inbound, ACL 101 Outbound). I'm able to FTP to host B(get connected to logon successfuly), but i can't transfer my data over. Any idea?

[paddyxdoyle]

Hi,

Is your FTP client operating in PORT mode or PASV mode?

This access list should work in PORT mode as the server (192.168.20.10) should talk back from tcp20 to a port number determined by the client

PASV mode is the other way round.

Add "access-list 101 deny ip any any log" to be bottom of your ACL and you should see why the packets are being dropped from your logs

HTH

PD

[dkblee]

hi!

how do i check whether is it PORT mode or PASV mode? The access-list by amikat is working. Is it considered Port Mode or PASV mode?

Thks!

[amikat · Accepted solution]

Hi,

From your post I understand that your hostA IP address is 192.168.10.10 and hostB IP address is 192.168.20.10. I also understand that hostB is FTP server side and it works in "classical" port mode.

If so, you may decide to apply the following outbound ACL:

access-list 101 permit tcp host 192.168.10.10 host 192.168.20.10 eq 21

access-list 101 permit tcp host 192.168.10.10 host 192.168.20.10 eq 20 est,

and the following inbound ACL:

access-list 102 permit tcp host 192.168.20.10 eq 21 host 192.168.10.10 est

access-list 102 permit tcp host 192.168.20.10 eq 20 host 192.168.10.10.

This is actually double checking approach, one ACL (inbound or outbound) will give you same result (you will be filtering either message or response).

Best regards,

Antonin

[dkblee]

hi!

Thks! Antonin, your acess-list worked.I noticed that, est command is often used. In what situation do i need to use this command?

what's the different between your access-list and the one that i used in my first msg(some sample from cisco doc)? Can you explain to me?

what's the different of putting the port number in the dest. and in the source? In ccna, it's all in the destination.

Thks!

[amikat]

Hi,

Well done!

Quick answers to your questions:

When you specify the parameter est (established) the ACL checks whether some control bits within tcp header are set (ACK,FIN,RST,SYN,URG). Effectively you are looking for the already established connection (ie. typically openened from the opposite end). The suggested ACL would work without this parameter as well, this gives you additional security.

Your post example of ACL 101 is likely a mixture of what is to be set. The reason you have not succeeded is that by your output access list you are permitting the ftp open connection (control) from hostA to hostB which is perfectly OK and also the packet sourced from hostB, tcp port 20 to host A (still output) - I doubt a packet like that may appear here as the ouput at all - and deny everything else (implicit deny any any at the end of ACL). So your ACL does not allow data connection, which typically goes from hostA, port greater than 1023 (you could add this parameter to suggested ACL and get a bit more security - not too much) to hostB port 20 (this is "classical" port mode ftp behaviour). I am not going to comment the sample you used as I have not seen it.

Your (input) ACL 102 is not too bad - not filtering ftp data - but will not help you to establish ftp data channel either.

If you specify tcp parameter in your ACL you can further say which tcp port you are looking for: either source or destination - these are standardized to some extent, so that is why you can allow or deny certain higher level protocols (applications) - the same applies to udp (here you cannot use the est parameter). Again I am not going to comment why in ccna it is all destination as you said - just be aware that you can use both.

I hope my English makes sense.

Good luck with your ccna!

Best regards,

Antonin

[dkblee]

hi!

another question is that, for the inbound acl you suggested, will i be enabling router2's host b to ftp to host A(router1)? I'm supposed to block all traffic from host B to host A. Thks!

access-list 101 permit tcp host 192.168.10.10 host 192.168.20.10 eq 21

access-list 101 permit tcp host 192.168.10.10 host 192.168.20.10 eq 20 est,

and the following inbound ACL:

access-list 102 permit tcp host 192.168.20.10 eq 21 host 192.168.10.10 est

access-list 102 permit tcp host 192.168.20.10 eq 20 host 192.168.10.10

[amikat]

Hi,

The answer is NO.

The inbound ACL (102) is filtering the same traffic on the input as the outbound ACL (101) on the output. As I have already mentioned, this is double checking and just one (either one from these two ACLs) will do the task, ie. allow ftp session from hostA (ftp client) to hostB (ftp server) and deny everything else. However while the final effect is the same, there is a subtle difference. If you decide to use one ACL only (either inbound or outbound), you are checking communication in one direction only and do not bother about the other. This may be considered a security hole opened for an attack.

There are further considerations when creating ACLs. One of the basic rules may advise to block the traffic we would like to block as soon as possible, ie. at the input (at least for the purpose the router will not bother to process the packet which is going to be discarded anyway). But sometimes you have no freedom like that as you need to allow the packet to be forwarded to some output and block to other, so here you must filter at the (particular) output. So even better would be to use the suggested ACL 101 on the INPUT port of hostA if possible (but as I have just indicated this may not be feasible due to other tasks).

And finally let us make clear how classical ftp session works, ie. what we have allowed:

Ftp client (hostA) opens control connection on the tcp port 21 of the tfp server (hostB). FTP server then negotiates the port for the data connection (with the originating tcp port 20) with the client suggesting the port greater then 1023 (client side). If they both agree the data is transfered and finally both channels are closed. ONLY in this sense you are allowing the ftp traffic from hostA to hostB and block all traffic from hostB to hostA. As you see perhaps the more precise specification would be you are allowing hostA to INITIATE the FTP SESSION to hostB and get the ftp data from hostB and you are blocking all OTHER traffic from hostB to hostA.

I hope this is not too complicated.

Best regards,

Antonin