On my 2821 ISR IOS Firewall 12.4(24T2), since I added a new ISP and then nat inside source route-maps, inside FTP clients successfully connect to outside servers using active FTP but no more with previous passive mode.
Many debugs were done: FTP server can't answer to LIST command outside acl rejects Syn/Ack packet because client's source port is not opened
I give you :
relevant config lines
Ios Debugs and packet capture
I also tried to add separate Nat pool with route-map but did not succeed
ip inspect name Cbac tcp router-traffic ip inspect name Cbac ftp
interface GigabitEthernet0/0 ip address L.L.L.5 255.255.255.0 ip access-group Acl_Inside in ip wccp web-cache redirect in ip inspect Cbac out ip nat inside no ip virtual-reassembly ip policy route-map Rm_Inside duplex auto speed auto ! interface FastEthernet0/0/3 switchport mode trunk ! interface Vlan304 ip address 10.10.8.250 255.255.255.0 ip access-group Acl_Outside in ip inspect Cbac out ip nat outside ip virtual-reassembly ! router eigrp 1 redistribute connected passive-interface default no passive-interface GigabitEthernet0/0 network L.L.L.0 0.0.0.255 auto-summary ! ip forward-protocol nd ip route M.M.M.M 255.255.255.255 10.10.8.251 ip nat inside source route-map Rm_Nat_NC interface Vlan304 overload
ip access-list extended Acl_Outside permit icmp any any deny ip any any log ! ip access-list extended Acl_Rm_Ftp permit tcp host 172.16.3.3 object-group OGn_Externe eq ftp ftp-data permit tcp host 172.16.3.3 object-group OGn_Externe gt 1024 ! route-map Rm_Inside permit 10 match ip address Acl_Rm_Ftp set ip next-hop 10.10.8.251 set interface Vlan304 ! route-map Rm_Nat_NC_Ftp permit 10 match ip address Acl_Rm_Ftp match interface Vlan304
I changed my config to the following and now both Active and Passive FTP work, but I can't explain nor test furthermore (users wil complain).
Main changes were to have only one route-map using 2 acls for inside G0/0, Dmz G0/1 Pbrs and for Nat Inside - outside, so it's simplier.
also noticed that :
- if I add or modify ACE lines, and clear Nat translations, I have to reload router because it doesnt works properly.
- other protocols do not support load-balancing: pop3, pptp/gre so I include them in acl route-map
interface GigabitEthernet0/0 ip address I.I.I.255.255.255.0 ip access-group Acl_Inside in ip wccp web-cache redirect in ip inspect Cbac out ip nat inside no ip virtual-reassembly ip policy route-map Rm_NC
interface GigabitEthernet0/1 ip address L.L.L.254 255.255.255.0 ip nat inside ip policy route-map Rm_NC
interface Vlan303 ip address 10.10.7.1 255.255.255.0 ip access-group Acl_Outside in ip inspect Cbac out ip virtual-reassembly
interface Vlan304 ip address 10.10.8.250 255.255.255.0 ip access-group Acl_Outside in ip inspect Cbac out ip nat outside ip virtual-reassembly
ip route M.M.M.M 255.255.255.255 10.10.8.251
ip nat inside source route-map Rm_Nat_NC interface Vlan304 overload
ip access-list extended Acl_Rm_Dmz permit ip host D.D.D..2 object-group OGn_Externe
route-map Rm_Nat_NC permit 10 match ip address Acl_Rm_Inside Acl_Rm_Dmz match interface Vlan304 ! route-map Rm_NC permit 10 match ip address Acl_Rm_Inside Acl_Rm_Dmz set ip next-hop verify-availability 10.10.8.251 1 track 7 set ip next-hop verify-availability 10.10.7.254 2 track 3
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...