ftp forwarding on pix515e

Unanswered Question
Jun 14th, 2008
User Badges:


Could someone help me with configuring FTP port forwarding with pix515e?.

Have tried this setup:

static (inside,outside) tcp 203.175.x.x 20 10.130.x.x 20

static (inside,outside) tcp 203.175.x.x. 21 10.130.x.x. 21

Then added it to the allow list of access-list.

Here is the complete setup.



>I just need to port forward ftp traffic to 10.130.x.x from the web.

>is it possible if i will be pointing an ftp traffic to 203.175.x.x ip from the web then the pix will forward it to 10.130.x.x ftp server?

I already made a post, but unfortunately i have given the incomplete setup and the guys that had replied are not yet available as of this time.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
hennigan Sat, 06/14/2008 - 23:57
User Badges:
  • Bronze, 100 points or more

Configure your statics without the port numbers.

static (inside,outside) 203.175.x.x 10.130.x.x

On the access-list permit ftp and ftp-data to the outside address.

access-list acl-in permit tcp any host 203.175.x.x eq ftp

access-list acl-in permit tcp any host 203.175.x.x eq ftp-data

Enable ftp fixup (PIX 6.x) or inspect ftp (PIX 7.x)

You need the static to not limit ports. This is to encompass both the initial control and data ports as well as high ports that will be used during the actual transfer. The fixup or inspect rule will allow stateful inspection and opening/closing of dynamic ports as required.

capajaron Sun, 06/15/2008 - 02:19
User Badges:


Is it ok if I will be using and ip address within 203.175.x.x block that's not being used?.



hennigan Sun, 06/15/2008 - 05:03
User Badges:
  • Bronze, 100 points or more

Yes. Use an address within the subnet of the outside interface other than that of the PIX itself.


This Discussion