I have disabled fixup ftp on the PIX 6.3 using "no fixup protocol ftp 21".
C:\>ftp 1.1.1.1
Connected to 1.1.1.1.
220 "Unauthorized access is prohibited!"
User (1.1.1.1:(none)): 12345
331 Please specify the password.
Password:
230 Login successful.
ftp> quote pasv
227 Entering Passive Mode (1,1,1,1,239,188)
ftp> ls -la
200 PORT command successful. Consider using PASV.
425 Failed to establish connection.
ftp>
Nov 15 10:49:07 2.2.2.2/2.2.2.2 %PIX-4-106023: Deny tcp src sout:1.1.1.1/35194 dst
stfin:3.3.3.3/3746 by access-group "outacl"
Nov 15 10:49:07 2.2.2.2/2.2.2.2 %PIX-4-106023: Deny tcp src sout:1.1.1.1/35194 dst
stfin:3.3.3.3/3746 by access-group "outacl"
Nov 15 10:49:10 2.2.2.2/2.2.2.2 %PIX-4-106023: Deny tcp src sout:1.1.1.1/35194 dst
stfin:3.3.3.3/3746 by access-group "outacl"
The FTP server 1.1.1.1 is at the outside leg of the PIX. The FTP client (3.3.3.3) is on the inside leg of the PIX. When the PIX is reverted back with "fixup protocol ftp 21", everything work. It seem that the "no fixup protocol ftp 21" actually break the FTP. My understanding is that "no fixup protocol ftp 21" is only applicable if you are using active FTP (where FTP server is at outside of the network and need the PIX to do deep packet inspection on FTP to permit the FTP's server data port TCP 20 to initiate back to the inside FTP client). For my case, the FTP client is inside and using passive FTP, thus all the connection (command and data) should be initiated from the client. By right, there should be no issue. However, the "no fixup protocol ftp 21" break the passive FTP from the client.
Please advise and thanks.
