Allow ports 21 & 1094 for FTP

[TimV]

I presently use:

access-list fromoutside permit tcp any host xxx.xxx.xxx.46 eq ftp

for allowing ftp clients into my ftp server. That is fine until I use SSL which wants to use port 1094 in addition to port 21.

The FTP session appears to hang from outside the PIX501, but inside obviously works fine.

How do I allow the additional port? Can I combine ports on a single line, or do I need to add a separate line allowing 1094?

Thanks,

Tim

 

[sunyasee]

Just add the line...

access-list fromoutside permit tcp any host xxx.xxx.xxx.46 eq 1094 ----

Sunyasee B-)

 

[TimV]

Thanks sunyasee!

 

[yizhar]

HI.

I don't know if this can work because of the following reason:

FTP uses 2 sessions (2 different ports).
The pix inspects (fixup) the FTP commands to know which ports need bo be open as needed.
With SSL - The traffic is encrypted so the pix cannot inspect it even if you set the "fixup ftp" command with the port used.
So - maybe it will work (if the server initiates additional sessions and not the client) and maybe not.
If not - try to read more about ftp over ssl behind a firewall.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[TimV]

Yizhar,

It is true that the ftp session still fails.

This is what I have found about ftp ssl behind a firewall:

To connect to an FTP Server that supports SSL and has a NAT address you should use Port Mode on the client. In WS_FTP Pro you need to uncheck the Passive Mode option at the connection screen.

If the FTP Client is using a NAT address:

To connect to an FTP server that supports SSL when your client machine is using a NAT address you should use Passive Mode on the client. In WS_FTP Pro you need to check the Passive Mode option at the connection screen.

If the FTP Server and FTP Client use a NAT address:

When both machines are using a NAT address a data connection cannot be established because the information is being encrypted and the Firewall is unable to decrypt the information.

In most cases the solution will be either to move the ftp server outside of the firewall so that NAT is no longer being performed or to switch to a Firewall that does not perform NAT.

 

[yizhar]

HI.

If it still does not work, you can try alternate solutions, like:

vpn.

https - with webdav or other solution to allow read and write access. This uses a single TCP connection on single port so it will probably work.

3rd party file transfer/sharing products, for example "ifolder" from novell.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar