NBAR classifying FTP traffic as unknown

fruition3000 · ‎12-14-2009

It is my understanding that NBAR is able to classify certain packets based on certain descriptors in the packet. It is also my understanding that the FTP client and server negotiate different port numbers once the session is initiated. I have enable NBAR protocol discovery on all ports and Debug NBAR unclassified port stats. Once the session is initiated all FTP traffic is classified as unknown with different port numbers. I have also tried using extended access lists to match some traffic but it only sees the initial traffic.

How can I classify FTP traffic coming into my router from the internet?

Peter Paluch · ‎12-21-2009

Hello,

Are you using NAT or TCP Intercept feature on the same router? I have had experiences when mixing these features with the NBAR that it did not work as expected. The NAT or TCP Intercept modify the original packet's header fields, thereby wreaking havoc with the NBAR. I have even made a note to myself that when the NBAR was enabled on a "NAT inside" interface, it was not able to properly classify the FTP flows which may well be the issue you are experiencing yourself.

Best regards,

Peter

fruition3000 · ‎12-26-2009

Thanks for the heads up but unfortunately I was setting this up in a lab environment to rollout at a customer site and this was setup without NAT or TCP intercept.

Peter Paluch · ‎12-26-2009

Hello,

Can you perhaps provide us with the following information?

The router platform and the IOS version you are using
The sanitized configuration of your router (without passwords and sensitive information)
The description of the FTP session you are testing (IP of the FTP client and server, active/passive mode, what exactly fails - the sesion setup or the file transfer)

Thank you!

Best regards,

Peter