Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ftp via vpn

I am having trouble getting client to connect to my ftp server via an established vpn.

On the server side we run a  pix 500 series with version 7 of the ios and on the client end an older 501 device with version 6.3 of the ios.

The vpn is established and working.

When I perform a telnet from the client side to the server on the other end of the VPN on port 21, I get an open response.

However when I use a FTP client to connect I do not get any further response beyond the initial connect.

It almost seems like the "inspect" command is not working properly and its rejecting traffic from the FTP server back to the client end thereby not sending the data port back to the client.

On the 515 side I see the following in the logs:

Jan 18 11:45:28 vpn1-active-dmz-cpt Jan 18 2010 10:59:14: %PIX-7-609001: Built local-host inside:ZA01_FTPonl_IPint
Jan 18 11:45:28 vpn1-active-dmz-cpt Jan 18 2010 10:59:14: %PIX-7-609001: Built local-host outside:CST_ZA03001_cl01
Jan 18 11:45:28 vpn1-active-dmz-cpt Jan 18 2010 10:59:14: %PIX-6-106015: Deny TCP (no connection) from ZA01_FTPonl_IPint/21 to CST_ZA03001_cl01/
52768 flags SYN ACK  on interface inside
Jan 18 11:45:28 vpn1-active-dmz-cpt Jan 18 2010 10:59:14: %PIX-7-609002: Teardown local-host inside:ZA01_FTPonl_IPint duration 0:00:00
Jan 18 11:45:28 vpn1-active-dmz-cpt Jan 18 2010 10:59:14: %PIX-7-609002: Teardown local-host outside:CST_ZA03001_cl01 duration 0:00:00

Is FTP possible like this via a VPN or is there a workaround for this?

Everyone's tags (4)
1 REPLY

Re: ftp via vpn

to see if the inspect is the issue - configure the client & server to use passive FTP and test again.

HTH>

644
Views
0
Helpful
1
Replies