Active FTP failing on ACE module

Unanswered Question
Dec 18th, 2009

I've setup FTP as show in the configuration examples.  Passive FTP works fine but for some reason active FTP breaks.

The client reported that he can authenticate to the FTP server with no problem.  However when he issues a FTP command such as LIST the connection just hangs.  Eventually he has to abort the connection. is my source NAT address.

PORT 10,24,32,75,239,165

200 PORT command successful.


150 Opening ASCII mode data connection for /bin/ls.

425 Can't open data connection.

When I look at the sniff trace between the NAT and server I see the ftp server initiate the ftp-data connection on port 20.  But then the ACE receives it and sends a reset back to the ftp server.

Anyone know of commands that can be executed that can show details as to why the connection gets reset by the ACE?

I have a TAC case opened but still waiting for an engineer to respond.  Just thought I'd post to see if anyone else has experienced this.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Eric Rose Fri, 12/18/2009 - 10:57

It sounds like you probably didn't configure FTP INSPECT rule for this VIP.

The ACE performs the FTP command inspection process as follows:

Prepares a dynamic secondary data connection. The channels are allocated in response to a file upload, a file download, or a directory listing event and must be prenegotiated. The port is negotiated through the PORT or PASV commands.


Eric Rose

JeramyKoval Fri, 12/18/2009 - 11:58

I triple checked that part of our configuration and made sure the inspect-ftp command was configured. 


This Discussion