ftp on alternate port

Unanswered Question
Dec 30th, 2009
User Badges:

I can't get through the firewall on port 5052. I'm using firezilla and it says that it does not recognize an unroutable address. it works over the vpn so it's something to do with the asa.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jerry Ye Wed, 12/30/2009 - 15:20
User Badges:
  • Cisco Employee,

Do you have firewall rules opened for this port?


Regards,

jerry

dlove Wed, 12/30/2009 - 16:02
User Badges:

Yes. A static and an access list.

Jerry Ye Wed, 12/30/2009 - 18:16
User Badges:
  • Cisco Employee,

Assuming static means static NAT. With limited information, I can only suggest two things.


1) Make sure all routing is correct when access through the firewall. Verify it with ping and traceroute

2) Remove FTP inspection (fixup) and re-test


Regards,

jerry

dlove Wed, 12/30/2009 - 18:32
User Badges:

This is all I have right now. I tried removing inspect with no luck.


access-list incoming extended permit tcp any host 68.216.158.101 eq 5052
static (inside,outside) tcp 68.216.158.101 5052 192.168.1.171 5052 netmask 255.255.255.255

Jerry Ye Wed, 12/30/2009 - 20:02
User Badges:
  • Cisco Employee,

Have you check your routing? (Not VPN)


You can also try to put a deny ip any any log at the end of the incoming ACL and send all the log to a syslog server to inspect what else is being blocked.


Regards,

jerry

vilaxmi Fri, 01/01/2010 - 13:01
User Badges:
  • Cisco Employee,

Hello,


If you wish to pass FTP traffic through your Firewall on NON STANDARD ports, then in order to make it work, please add the following MPF (modular Policy Framework) :-



Lets assume you have FTP server (1.1.1.1) on outside of your ASA , and you have clients in inside which needs to access the server. First of all, remove inspect ftp from global_policy and the proceed as follows for non std FTP inspection.


access-list FTP extended permit tcp any host 1.1.1.1 range 20 21

access-list FTP extended permit tcp  host 1.1.1.1 any range 20 21


class-map class_ftp

match access-list FTP

!

Policy-map global_policy

class class_ftp

inspect ftp

!


service-policy global_policy global


HTH


Vijaya

Actions

This Discussion