DMZ in ASA configuration.

[itdsmartnet]

hi, i have placed my FTP server in DMZ , with its public ip address xx.xx.xx.9, i want my inside clients and outside clients access with the same ip address.My configuration is as follow.

static (DMZ,outside) xx.xx.xx.9 10.5.0.5 netmask 255.255.255.255

static (inside,DMZ) 30.30.30.0 30.30.30.0 netmask 255.255.255.252

static (DMZ,inside) xx.xx.xx.9 10.5.0.5 netmask 255.255.255.255

access-list outside_int extended permit tcp any host xx.xx.xx.9 eq ftp

access-group outside_int in interface outside

Now the problem is that when i upload file from inside or from outside, after uploading 5-10% it gives me error "[9/16/2008 12:05:57 PM] Child transfer failed." i can download from that FTP server.

When i placed that FTP in my local LAN it works fine, it can upload as well as download on local LAN for LAN users.

Please help me in this matter.

Thanks

[steve_steele]

If it gets 5 - 10% through the transfer I doubt that NAT or your access-list are any part of the problem.

http://kb.globalscape.com/article.aspx?id=10295 suggests that the error could be to do with the application.

You could try turning on ftp inspection.

HTH

Steve

[itdsmartnet]

how can i tune ftp inspection.

[satish_zanjurne]

Hi,

To tune FTP inspection to a level , use strict option.

Using the strict option with the inspect ftp command increases the security of protected networks by

preventing web browsers from sending embedded commands in FTP requests.

After you enable the strict option on an interface, FTP inspection enforces the following behavior:

• An FTP command must be acknowledged before the security appliance allows a new command.

• The security appliance drops connections that send embedded commands.

• The 227 and PORT commands are checked to ensure they do not appear in an error string.

If the strict option is enabled, each FTP command and response sequence is tracked for the following

anomalous activity:

• Truncated command-Number of commas in the PORT and PASV reply command is checked to see

if it is five. If it is not five, then the PORT command is assumed to be truncated and the TCP

connection is closed.

• Incorrect command-Checks the FTP command to see if it ends with characters, as

required by the RFC. If it does not, the connection is closed.

• Size of RETR and STOR commands-These are checked against a fixed constant. If the size is

greater, then an error message is logged and the connection is closed.

• Command spoofing-The PORT command should always be sent from the client. The TCP

connection is denied if a PORT command is sent from the server.

• Reply spoofing-PASV reply command (227) should always be sent from the server. The TCP

connection is denied if a PASV reply command is sent from the client. This prevents the security

hole when the user executes “227 xxxxx a1, a2, a3, a4, p1, p2.”

• TCP stream editing-The security appliance closes the connection if it detects TCP stream editing.

• Invalid port negotiation-The negotiated dynamic port value is checked to see if it is less than 1024.

As port numbers in the range from 1 to 1024 are reserved for well-known connections, if the

negotiated port falls in this range, then the TCP connection is freed.

• Command pipelining-The number of characters present after the port numbers in the PORT and

PASV reply command is cross checked with a constant value of 8. If it is more than 8, then the TCP

connection is closed.

• The security appliance replaces the FTP server response to the SYST command with a series of Xs.

to prevent the server from revealing its system type to FTP clients. To override this default behavior,

use the no mask-syst-reply command in the FTP map.

For additional inspection control..you can use FTP inspection policy map.

HTH...rate if helpfull..