Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ftp and pix

I have a pix 515E and I am trying to get the ftp server accessile from the outside.

I already have an ftp server that is working without any problems but the new ftp server is not accessible from the outside.

my access list is:

access-list OUTSIDE1-IN permit tcp any host (public ip) eq ftp

The server is natted as:

static (inside,outside1) (public ip) (inside ip) netmask 0 0

The only difference between the two servers is that the working one is in the dmz.


Re: ftp and pix

Hi Musumani,

What version of software is your PIX running? If it is 7.2(1) or later, take a look at the output of this command:

packet-tracer input outside1 tcp 1024 21

Command reference:

That should give you a hint as to where the traffic is failing.

If the PIX is running 7.0(1) or later, you might also look at the output of 'show asp drop' for reasons why packets are being dropped.

Command reference:

It might also be worthwhile to setup some captures and see exactly where the connection is failing (i.e. the initial traffic or the return traffic). Here is the command reference for the capture command if you are running 6.2(1) or later:


New Member

Re: ftp and pix

Do you have ftp inspection enabled, using either fixup protocols or mpf policies?

fixup protocol ftp


policy-map global_policy

class inspection_default

inspect ftp

(This depends on your code version)


New Member

Re: ftp and pix

yes I do.

New Member

Re: ftp and pix

What version are you using on the PIX? If you are trying to do port redirection I don's see port 21 in the Static NAT statement, you might need something like this (v6.3)

static (inside,outside1) tcp (public IP) ftp (inside IP) ftp netmask

However on version 7.2 (I believe) you have to state the name of the outside interface instead of the IP i.e.

static (inside,outside) tcp outside1 ftp (inside IP) ftp netmask

This is from memeory but I think it's right, unless I have misunderstood your problem.

I have port redirection on a 515 running v7.2 for OWA and OMA (HTTPS) so if the above doesn't work I can get the config when I have access and post it here if that helps.

CreatePlease to create content