Hi,

You could always take a packet capture on the firewall and/or on the actual host to see where the communication stops.

You could for example configure the ASA to capture the traffic between the client and the server.

Example configuration could be

access-list FTP-CAP permit ip host host

access-list FTP-CAP permit ip host host

capture FTP-CAP type raw-data access-list FTP-CAP interface buffer 10000000

You could naturally also capture the traffic on the internal side of the firewall if you want to compare the 2 captures on both sides of the firewall

access-list FTP-CAP-INTERNAL permit ip host host

access-list FTP-CAP-INTERNAL permit ip host host

capture FTP-CAP-INTERNAL type raw-data access-list FTP-CAP-INTERNAL interface buffer 10000000

You can then use the following command to confirm if traffic is captured

show capture

You can use the following command to show the capture on the CLI

show capture FTP-CAP

show capture FTP-CAP-INTERNAL

I would suggest copying the actual captures to your computer with following commands and then viewing the contents with Wireshark

copy /pcap capture:FTP-CAP tftp://x.x.x.x/FTP-CAP.pcap

copy /pcap capture:FTP-CAP-INTERNAL tftp://x.x.x.x/FTP-CAP-INTERNAL.pcap

You can remove the captures from the ASA with

no capture FTP-CAP

no capture FTP-CAP-INTERNAL

The ACLs will have to be removed separately.

These captures should give you a picture what happens to the FTP connection.

- Jouni