Okay, I figured out what I was doing and now I understand that I really need to look at my specific image: c1700-y-mz.124-16. This image does NOT support "ip inspect".
It seems odd that this images only has the "IP" feature set but requires 48/16 while my 2621 running c2600-io3-mz.123-1a includes "IP/FW/IDS" and only requires 32/8.
My 1721 only has 48/32 so I am unable to go with c1700-advipservicesk9-mz.12.4-16 which requires 96/32 but seems like it would support inspection.
*** Perhaps there's another way to accomplish what I need to do. I simply need to allow FTP access to an internal IP address. The way I've dones this in the pass is with the "ip inspect name ftpfilter ftp timeout 30" command and then do "ip inspect ftpfilter in" on my public facing interface.
*** Is there another way to accomplish this with just the IP feature set?
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...