Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

LDIR 416 version 3.2.3 - "assign" problem

After a long time of having all the virtual servers' ports open to any IP, I decided to restrict access to some of them to the IPs that needed them.

So I restricted access to the Terminal Server port (3389) only to the company's IP, but left the HTTP (80) and FTP (21) ports open to any IP.

However, after applying the change, the FTP port now appears to be blocked to any connection. The only way to unblock it is by restricting access to it to the company's IP, but in that case the other IPs won't be able to connect to it anyway. The HTTP port keeps working as usual.

Why did this happen, and how can I fix it?

Here is an example of what I had before the changes:

virtual <virtual_server_ip>:3389:0:tcp is

virtual <virtual_server_ip>:21:0:tcp is

virtual <virtual_server_ip>:80:0:tcp is

real <real_server_ip>:3389:0:tcp is

real <real_server_ip>:21:0:tcp is

real <real_server_ip>:80:0:tcp is

bind <virtual_server_ip>:3389:0:tcp <real_server_ip>:3389:0:tcp

bind <virtual_server_ip>:21:0:tcp <real_server_ip>:21:0:tcp

bind <virtual_server_ip>:80:0:tcp <real_server_ip>:80:0:tcp

And here is what I have after the changes:

virtual <virtual_server_ip>:3389:1:tcp is

virtual <virtual_server_ip>:21:0:tcp is

virtual <virtual_server_ip>:80:0:tcp is

real <real_server_ip>:3389:1:tcp is

real <real_server_ip>:21:0:tcp is

real <real_server_ip>:80:0:tcp is

bind <virtual_server_ip>:3389:1:tcp <real_server_ip>:3389:1:tcp

bind <virtual_server_ip>:21:0:tcp <real_server_ip>:21:0:tcp

bind <virtual_server_ip>:80:0:tcp <real_server_ip>:80:0:tcp

assign <virtual_server_ip>:3389:1:tcp <company_ip> 255.255.255.255

As expected, Terminal Server is now accessible only from the company's IP address, while the HTTP port is accessible from any IP. So should be the FTP port, but instead it doesn't work at all (connection failed).

Any help would be greatly appreciated.

Michele Lostia

  • Application Networking
1 REPLY
Silver

Re: LDIR 416 version 3.2.3 - "assign" problem

Hi Michele,

The best way out in this case would be to use a Router that supports Access Lists or a firewall that will permit or deny certain users and also for the specific ports. The configuration seems fine to me, however I have not been able to detect the cause for the FTP connection not working. You could also check if there is a bug related to this.

90
Views
0
Helpful
1
Replies
This widget could not be displayed.