Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

FTP

Dear All,

I am not able to access FTP from internal network or office, if i connect from other then my office i can access.

What port i have to enable on ASA 5510 & ISA???

5 REPLIES
Community Member

Re: FTP

Hi,

I assume that the office connected interface is configured as inside with security-level 100.

Check the following:

1. ACL bounded to inside interface

asa(config)# show run access-group

if it results: access-group inside_access_in in interface inside

then: show run access-list inside_access_in

verify if the acl has: access-list insidie_access_in permit tcp 192.168.57.0 255.255.255.0 any eq ftp

where 192.168.57.0 is your office network.

if your network has no such acl add one.

2. Check your service policy

run command:asa(config)# sh run service-policy

check: if there is global_policy or interface policy applied to inside interface.

3. Check what protocols are inspected

run command: sh run policy-map

find: the policy and verify "inspect ftp" is there in inside class-map of policy-map applied to inside interface.

if you don't find one, add one.

If possible, post your config for review

H2H

Roshan

Community Member

Re: FTP

Dear Roshan,

Thanks for your answer, but i would like to elaborate.....i have my ftp server some outside my network on a public ip n from my network i cannot access it.i have enable the port 20 & 21 but still i m not able to access....

Community Member

Re: FTP

Further to Roshans earlier post, once the ACL is added (or confirmed that you have one) run the following command to ensure that the ACL has a hit count.

sho access-list

Also, ensure that this FTP server is accessible from the outside of your network, if possible setup a directly connected machine to your internet connection (purely for testing!)

HTH

Steve

Community Member

Re: FTP

Dear ,

Below is the access-list which are configured on ASA. But still i am not able to access FTP site.

access-list out-in line 22 extended permit tcp any eq ftp any eq ftp (hitcnt=0)

access-list out-in line 23 extended permit tcp any gt 1023 any gt 1023 (hitcnt=3517)

access-list out-in line 24 extended permit tcp any eq ftp-data any eq ftp-data (hitcnt=0)

Community Member

Re: FTP

Please can you post your access-group config so I can see what direction the ACLs have been applied.

Steve

146
Views
0
Helpful
5
Replies
CreatePlease to create content