This is the mst relevent forum I can find. Please help, or direct me to a more suitable one.

I have a problem:

I am running a dell poweredge 1650 server, with Windows 2003 web edition.

I have IIS6 running websites and ftp.

Microsoft DNS

Ability mail server

 

Software firewall (sygate personal)

 

Hardware firewall (xyzel 652H)

 

The problem is that users can access DNS info and websites (eg. www.leedsmedics.co.uk), but not gain ftp access to the server.

When I disable the hardware firewall everything works fine, but clearly this is not an acceptable solution.

 

I am forwarding port 21 and 20 in both directions on the firewall and so can’t understand why it is not working, especially as the other applications work fine.

The software has statefull packet inspection and denial of service blocking. The ip of the ftp server is 195.206.163.194.

One user has connected successfully once and then could not connect again for a while.

 

When the firewall is disabled there is no problem. When I forward all the traffic, it doesn’t work.

 

Anyone have any ideas?

 

Steve

Is your FTP server in a DMZ?

Your firewall does stateful packet inspection.  How FTP-aware is it?  FTP can and will need to open more ports than just 20 and 21, and your firewall will need to open those ports for the FTP server.

Want the best answers? Ask the best questions!

TANSTAAFL!!

Here's a document you may want to read.

http://slacksite.com/other/ftp.html

If you're allowing only specified ports in and out, and denying everything else, you may want to try allowing ALL ports on established outbound connections.  (The Cisco IOS command would be

access-list 100 permit tcp any any established (on your external interface)

Here's what I have in my access list:
access-list 100 permit tcp any gt 1023 host xxx.xxx.xxx.xxx eq ftp
access-list 100 permit tcp any gt 1023 host xxx.xxx.xxx.xxx eq ftp-data
access-list 100 permit tcp any gt 1023 host xxx.xxx.xxx.xxx established

Hope this helps.