The ACLs which contain port 20 is overkill.

If you block command and control port (21),

there is no point in blocking data transfer

port (20).

Besides, the acl for port 20 is useless if the

user(s) use Active ftp.

David

David

Having port 20 in the access-list is hardly overkill to be honest. It's a layer 3 switch and a 7 line access-list should really be okay. i was trying to explain the concept of access-list order and as most people know ftp works on 2 ports i thought it should have both. It really won't do any harm.

Agreed on the active ftp but some people do use passive :-)

Jon

The point I am trying to make here is that

it is NOT necessary to do so. Imagine if you

do it in the Security lab, you will fail. Once

you block command and control port (tcp port

21) , it is irrelevant to block tcp port 20.

You will not get any hits in this ACL line.

David

CCIE Security

Okay well that's a bit of worry as Cisco doc for blocking ftp shows both ports being blocked

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml#denyftp

So follow their example and fail the lab !.

Point i was trying to make was that we aren't taking a lab. May not be necessary but won't do any harm either.

Anyway lets not get into an argument about it. The access-list will work whether port 20 is included or not and there will be no adverse effects whichever the original poster uses.

Jon