Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

ftp through two NAT...

Hello!

I have some trouble with these configuration:

We use 2 firewalls. PIX 515 attached to Internet with NAT (many to one NAT) enabled and MS ISA 2004 connected to PIX and LAN.

Clients that use ISA 2004 as WEB proxy receive following message:

ISA Server: extended error message :

200 Switching to Binary mode.

500 Illegal PORT command.

but client that use ISA as NAT have not any problem...

If i connect ISA directly to Internet (or use Zyxel Prestige with Single User Access instead PIX) the problem disappear.

The problem could be in features of working FTP-protocol?

What i should configure on PIX to resolve problem?

Thank you all!!!

1 ACCEPTED SOLUTION

Accepted Solutions

Re: ftp through two NAT...

Hello,

does this happen with clients using active FTP?

In this case try to use passive FTP - depending on the client software there are different ways to configure it on the clients.

Or does this happen in active and passive FTP connections?

Usually a "fixup protocol FTP 21" in the PIX solves the problems, though this should be in the PIX config by default.

Hope this helps! Please rate all posts.

Regards, Martin

1 REPLY

Re: ftp through two NAT...

Hello,

does this happen with clients using active FTP?

In this case try to use passive FTP - depending on the client software there are different ways to configure it on the clients.

Or does this happen in active and passive FTP connections?

Usually a "fixup protocol FTP 21" in the PIX solves the problems, though this should be in the PIX config by default.

Hope this helps! Please rate all posts.

Regards, Martin

215
Views
0
Helpful
1
Replies