Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations derfloh on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

ACL for ftp - 520

Status
Not open for further replies.
yert33

yert33

Programmer
Joined
Feb 19, 2002
Messages
255
Location
US
I have an ftp server in my dmz1. I've made these entries into my config:

access-list acl_out permit tcp any host x.x.x.69 eq ftp
access-list acl_out permit tcp any host x.x.x.69 eq ftp-data
access-list acl_out permit udp any host x.x.x.69 eq 20
access-list acl_out permit udp any host x.x.x.69 eq 21

I opened both tcp and udp for both ports 20 and 21 in order to try and get past this error I get when trying to access the ftp server:

425 Can't open data connection.

Using Netscape 7.1 with the URL: ftp://ourdomain.com.

The ftp server is IIS 5.0 with the default anonymous login allowed.

Any clues, mates?

TIA

Trey
 
Sort by date Sort by votes
You've got fixup protocol ftp 21 in your config?

Where have you applied that acl, on what interface in which direction?
 
Upvote 0 Downvote
I agree with chicouk,

apply using
access-group acl_out in interface INSIDE
fixup protocol ftp 21
write mem

then try connecting and do:

show access-group acl_out

and look at your counters.

at least then you'll know if you are traversing the firewall or getting hung-up in IIS.



MCSE/MCDBA
SANS GIAC + SANS FIREWALL
 
Upvote 0 Downvote
doh, I meant

show access-list acl_out



MCSE/MCDBA
SANS GIAC + SANS FIREWALL
 
Upvote 0 Downvote
Thanks to all for your replies. Here is my complete config. (I don't know why I just don't do this in the beginning.... sorry)

: Written by enable_15 at 20:20:20.366 UTC Tue Dec 2 2003
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
interface ethernet2 100full
interface ethernet3 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security40
nameif ethernet3 dmz2 security20
enable password * encrypted
passwd * encrypted
hostname *
domain-name *
no fixup protocol ftp 21
no fixup protocol h323 h225 1720
no fixup protocol h323 ras 1718-1719
no fixup protocol http 80
no fixup protocol ils 389
no fixup protocol rsh 514
no fixup protocol rtsp 554
no fixup protocol sip 5060
no fixup protocol sip udp 5060
no fixup protocol skinny 2000
no fixup protocol smtp 25
no fixup protocol sqlnet 1521
names
access-list compiled
access-list acl_out permit tcp any host x.x.x.67 eq www
access-list acl_out permit udp any host x.x.x.67 eq 80
access-list acl_out permit tcp any host x.x.x.67 eq lotusnotes
access-list acl_out permit udp any host x.x.x.67 eq 1352
access-list acl_out permit tcp any host x.x.x.67 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.67 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.67 eq smtp
access-list acl_out permit tcp any host x.x.x.68 eq www
access-list acl_out permit udp any host x.x.x.68 eq 80
access-list acl_out permit tcp any host x.x.x.68 eq lotusnotes
access-list acl_out permit udp any host x.x.x.68 eq 1352
access-list acl_out permit tcp any host x.x.x.68 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.68 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.68 eq smtp
access-list acl_out permit tcp any host x.x.x.69 eq www
access-list acl_out permit udp any host x.x.x.69 eq 80
access-list acl_out permit tcp any host x.x.x.69 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.69 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.69 eq domain
access-list acl_out permit udp any host x.x.x.69 eq domain
access-list acl_out permit tcp any host x.x.x.70 eq citrix-ica
access-list acl_out permit udp any host x.x.x.70 eq 1494
access-list acl_out permit tcp any host x.x.x.71 eq www
access-list acl_out permit udp any host x.x.x.71 eq 80
access-list acl_out permit tcp any host x.x.x.72 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.72 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.73 eq citrix-ica
access-list acl_out permit udp any host x.x.x.73 eq 1494
access-list acl_out permit tcp any host x.x.x.74 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.74 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.75 eq www
access-list acl_out permit udp any host x.x.x.75 eq 80
access-list acl_out permit tcp any host x.x.x.75 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.75 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.75 eq domain
access-list acl_out permit udp any host x.x.x.75 eq domain
access-list acl_out permit tcp any host x.x.x.76 eq www
access-list acl_out permit udp any host x.x.x.76 eq 80
access-list acl_out permit tcp any host x.x.x.77 eq ftp
access-list acl_out permit tcp any host x.x.x.77 eq ftp-data
access-list acl_out permit udp any host x.x.x.77 eq tftp
access-list acl_out permit tcp any host x.x.x.79 eq citrix-ica
access-list acl_out permit udp any host x.x.x.79 eq 1494
access-list acl_out permit tcp any host x.x.x.80 eq citrix-ica
access-list acl_out permit udp any host x.x.x.80 eq 1494
access-list acl_out permit tcp any host x.x.x.82 eq citrix-ica
access-list acl_out permit udp any host x.x.x.82 eq 1494
access-list acl_out permit tcp any host x.x.x.84 eq www
access-list acl_out permit udp any host x.x.x.84 eq 80
access-list acl_out permit tcp any host x.x.x.84 eq ftp
access-list acl_out permit tcp any host x.x.x.84 eq ftp-data
access-list acl_out permit tcp any host x.x.x.84 eq lotusnotes
access-list acl_out permit udp any host x.x.x.84 eq 1352
access-list acl_out permit tcp any host x.x.x.84 eq pcanywhere-data
access-list acl_out permit udp any host x.x.x.84 eq pcanywhere-status
access-list acl_out permit tcp any host x.x.x.84 eq smtp
access-list acl_out permit tcp any host x.x.x.93 eq ftp
access-list acl_out permit udp any host x.x.x.93 eq 21
access-list acl_out permit tcp any host x.x.x.93 eq telnet
access-list acl_out permit udp any host x.x.x.93 eq 23
access-list acl_out permit tcp any host x.x.x.73 eq 1604
access-list acl_out permit udp any host x.x.x.73 eq 1604
access-list acl_out permit tcp any host x.x.x.79 eq 1604
access-list acl_out permit udp any host x.x.x.79 eq 1604
access-list acl_out permit udp any host x.x.x.80 eq 1604
access-list acl_out permit tcp any host x.x.x.80 eq 1604
access-list acl_out permit tcp any host x.x.x.82 eq 1604
access-list acl_out permit udp any host x.x.x.82 eq 1604
access-list acl_out permit udp any host x.x.x.70 eq 1604
access-list acl_out permit tcp any host x.x.x.70 eq 1604
access-list acl_out permit tcp any host x.x.x.67 eq pop3
access-list acl_out permit tcp any host x.x.x.67 eq imap4
access-list acl_out permit tcp any host x.x.x.67 eq 81
access-list acl_out permit tcp any host x.x.x.81 eq 1433
access-list acl_out permit tcp any host x.x.x.81 eq 2112
access-list acl_out permit tcp any host x.x.x.81 eq https
access-list acl_out permit tcp any host x.x.x.69 eq ftp
access-list acl_out permit tcp any host x.x.x.69 eq ftp-data
access-list acl_out permit udp any host x.x.x.69 eq 20
access-list acl_out permit udp any host x.x.x.69 eq 21
access-list acl_dmz2 permit tcp any any
access-list acl_dmz2 permit icmp any any
access-list acl_dmz2 permit udp any any
access-list acl_dmz1 permit tcp any any
access-list acl_dmz1 permit udp any any
access-list acl_dmz1 permit icmp any any
access-list acl_inside permit tcp any any
access-list acl_inside permit udp any any
access-list acl_inside permit icmp any any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
mtu dmz2 1500
ip address outside x.x.x.66 255.255.255.224
ip address inside my.inside.net.4 255.255.255.0
ip address dmz1 my.dmz1.net.4 255.255.255.0
ip address dmz2 my.dmz2.net.4 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz1
no failover ip address dmz2
pdm history enable
arp timeout 14400
global (outside) 1 x.x.x.94 netmask 255.255.255.224
global (dmz1) 1 my.dmz1.net.94 netmask 255.255.255.0
global (dmz2) 1 my.dmz2.net.94 netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz1) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz2) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) x.x.x.67 my.inside.net.12 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.68 my.inside.net.13 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.70 my.inside.net.16 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.71 my.inside.net.6 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.72 my.inside.net.21 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.73 my.inside.net.17 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.74 my.inside.net.14 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.76 my.inside.net.1 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.77 my.inside.net.10 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.79 my.inside.net.18 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.80 my.inside.net.19 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.81 my.inside.net.15 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.82 my.inside.net.20 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.84 my.inside.net.24 netmask 255.255.255.255 0 0
static (dmz1,outside) x.x.x.75 my.dmz1.net.11 netmask 255.255.255.255 0 0
static (dmz1,outside) x.x.x.69 my.dmz1.net.9 netmask 255.255.255.255 0 0
static (inside,dmz1) my.dmz1.net.15 my.inside.net.12 netmask 255.255.255.255 0 0
static (dmz2,outside) x.x.x.93 my.dmz2.net.12 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_inside in interface inside
access-group acl_dmz1 in interface dmz1
access-group acl_dmz2 in interface dmz2
route outside 0.0.0.0 0.0.0.0 x.x.x.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http my.inside.net.10 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet my.inside.net.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
terminal width 80
 
Upvote 0 Downvote
As previously advised... the problem is the fixup protocol.
From your config: no fixup protocol ftp 21

you need: fixup protocol ftp 21
 
Upvote 0 Downvote
Thank you TheMut. That was it. And now I see it plainly documented on the online Cisco PIX command page.

Thanks again.



 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Sparrow4
  • Locked
  • Question Question
Configure Avaya IPO R11 / VM Pro + Office365 or Exchange for voicemail to email
Replies
2
Views
1K
Johnkite
Johnkite
tklamb
  • Locked
  • Question Question
ACL help
Replies
0
Views
312
tklamb
tklamb
XLNTech1
  • Locked
  • Question Question
iptables port forwarding
Replies
0
Views
844
XLNTech1
XLNTech1
Shmid
  • Locked
  • Question Question
Restricting Sonicwall SSL-VPN users for WAN access
Replies
7
Views
1K
Shmid
Shmid
WhosYourDiffie
  • Locked
  • Question Question
Cisco ASA 5506 VPN for Avaya Phones
Replies
0
Views
415
WhosYourDiffie
WhosYourDiffie

Part and Inventory Search

Sponsor

Back
Top