FTP issue across ACE context

Unanswered Question
Jan 27th, 2008
User Badges:

Hi Sir,

I'm performing basic testing of ACE (ACE20-MOD-K9) on a Catalyst 6509 switch with redundant Supervisor Engine 720.

The switch runs Native IOS version 12.2(18)SXF12a. ACE software Version is 3.0(0)A1(4a).

I'm testing an ACE context. Its config is as attached.

Client IP :

VIP : tcp eq ftp & tcp eq ftp-data

Real Server :

The client can establish FTP connection to the VIP But when it tries to execute the "ls" command, the files were not listed and I received the following error:


Connected to

220 3Com 3CDaemon FTP Server Version 2.0

User ( testuser

331 User name ok, need password


230 User logged in

ftp> ls

200 PORT command successful.

226 Closing data connection


Also attached is the output of "show conn" on the ACE. It looks like Active FTP to me. Can you explain why the FTP data connection cannot be established successfully across the ACE context? What did I miss in my config? Since it is Active FTP, as far as I know the server initiates the data connection. Does the issue have anything to do with the fact that real servers can't initiate outbound connection unless NAT is configured?

Please help.

Thank you.


Lim TS

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Gilles Dufour Mon, 01/28/2008 - 02:54
User Badges:
  • Cisco Employee,

Add the command 'inspect ftp' under your policy-map

policy-map multi-match lb-vip

class VIP-FTP-100

inspect ftp

Also, since you are in test mode, you should upgrade asap to A1(6.3)


limtohsoon Mon, 01/28/2008 - 06:33
User Badges:

Hi Gilles,

Thanks for your reply.

I will try the "inspect ftp" command and upgrade the ACE to 3.0(0)A1(6.3) asap.

By the way, do I need the command "match virtual-address tcp eq ftp-data" under "class-map match-any VIP-FTP-100" ?

One more question: What's the difference in terms of L4-L7 load balancing functionality between a context in routed mode and a context in bridge mode?

Thank you.


Lim TS

Gilles Dufour Mon, 01/28/2008 - 11:18
User Badges:
  • Cisco Employee,

you don't need to match the ftp-data port traffic.

If you apply inspect ftp, the data port will be open automatically but this can only be done with inspect ftp configured.

There is no difference between bridge mode and routed mode.


limtohsoon Tue, 01/29/2008 - 06:24
User Badges:

Hi Gilles,

Thanks for your solution. It solves my issue.

I posted a question about the availability of any CSM to ACE conversion tool to which you replied. However I don't get what you mean. Can you kindly advise me again?

Thank you.


Lim TS


This Discussion