Active FTP failing on ACE module

JeramyKoval · ‎12-18-2009

I've setup FTP as show in the configuration examples. Passive FTP works fine but for some reason active FTP breaks.

The client reported that he can authenticate to the FTP server with no problem. However when he issues a FTP command such as LIST the connection just hangs. Eventually he has to abort the connection. 10.24.32.75 is my source NAT address.

PORT 10,24,32,75,239,165

200 PORT command successful.

LIST

150 Opening ASCII mode data connection for /bin/ls.

425 Can't open data connection.

When I look at the sniff trace between the NAT and server I see the ftp server initiate the ftp-data connection on port 20. But then the ACE receives it and sends a reset back to the ftp server.

Anyone know of commands that can be executed that can show details as to why the connection gets reset by the ACE?

I have a TAC case opened but still waiting for an engineer to respond. Just thought I'd post to see if anyone else has experienced this.

Eric Rose · ‎12-18-2009

It sounds like you probably didn't configure FTP INSPECT rule for this VIP.

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/security/guide/appinsp.html#wp1310518

The ACE performs the FTP command inspection process as follows:

•Prepares a dynamic secondary data connection. The channels are allocated in response to a file upload, a file download, or a directory listing event and must be prenegotiated. The port is negotiated through the PORT or PASV commands.

Thanks

Eric Rose

JeramyKoval · ‎12-18-2009

I triple checked that part of our configuration and made sure the inspect-ftp command was configured.

Gilles Dufour · ‎12-21-2009

We'll need to see your config and the sniffer trace.

G.