Comments on: ASA allow passive ftp traffic

By: Tom

Tom — Wed, 10 Aug 2011 20:33:53 +0000

Hi,

This point is really interesting beacause on ASA 5510 the stateful application inspection feature is enable by default insead of on ASA 5505.

Thank you and nice work .

Tom.

By: Ankur Patel

Ankur Patel — Wed, 22 Jun 2011 14:29:32 +0000

Hi Dear,

as per above conversation i have issue with passive http://FTP.here are some my test observation below.

the client PC (Filezilla client) is connect to our vendor FTP server on port 8022 but from client are able to estblished control channel connection with the server and when we usded command PASV for data channel we are not able to connect to the server.

client—Inside(ASA)Outside—–Server

-i configure the ASA firewall to inspect the 8022 port into FTP inspection rule (but i have’t inspect 1023-65535 port rang) but it’s not working after PASV command.

can you please suggest me how perfect way to configure the my firewall to resolved this issue ASAP ? OR any tips to help me out to resoved this issue

Thanks in advance for understanding

Ankur

By: BioGuyver

BioGuyver — Tue, 14 Dec 2010 17:12:04 +0000

This article solved all my problems with FTP so thanks for that.
The thing I did find is that I was not already running policy mapping on the old firewall. For this to work you also need to add a line like this:
service-policy global-policy global

Thanks

By: Windy

Windy — Thu, 09 Dec 2010 21:10:49 +0000

This is common sense, but most of cases it doesn’t help in passing ftp passive client through ASA unfortunately.

By: harald

harald — Mon, 29 Jun 2009 12:51:19 +0000

this was very interesting, thanks. however, i have still a problem. i can connect through the firewall using activ and “extended passive”(!), but not “passiv” (non-extended passive). even after applying your configuration. is there away around this problem? thanks!

By: max

max — Thu, 02 Apr 2009 14:51:31 +0000

I’m glad you found this article useful.

By: RaiulBaztepo

RaiulBaztepo — Tue, 31 Mar 2009 12:45:46 +0000

Hello!
Very Interesting post! Thank you for such interesting resource!
PS: Sorry for my bad english, I’v just started to learn this language
See you!
Your, Raiul Baztepo