Configuring FTP access through Firewall

[peterc66]

Everything I can find online says to setup a static route for FTP, but when I do that I am unable to browse back outside to the web. So here is the config setup in the state where all is working well and now I just need to add the correct statements to allow FTP to pass through the PIX.
Internal servers are Network Load Balanced to 162.x.x.20 and the outside address is 217.x.x.30.

Pix1(config)# show config
: Saved
: Written by at 11:52:03.213 PDT Sat Oct 30 2004
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
clock timezone PST -8
clock summer-time PDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol ftp 1021
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside permit tcp any any
access-list inside permit udp any any
access-list inside permit gre any any
access-list inside permit ip any any
access-list outside permit tcp any host 217.x.x.26 eq pptp
access-list outside permit gre any host 217.x.x.26
access-list outside permit tcp any host 217.x.x.30 eq telnet
access-list outside permit icmp any any echo-reply
access-list outside permit gre any any
access-list outside permit tcp any any eq pptp
access-list outside permit tcp any host 217.x.x.30 eq ftp
access-list outside permit tcp any host 217.x.x.30 eq 1021
access-list outside permit tcp any host 217.x.x.30 eq www
access-list outside permit tcp any host 217.x.x.30 eq 5900
access-list inside_access_in permit udp any any
access-list inside_access_in permit tcp any any
access-list inside_access_in permit ip any any
access-list inside_access_in permit gre 162.18.0.0 255.255.0.0 any
pager lines 24
logging on
logging console debugging
mtu outside 1500
mtu inside 1500
ip address outside 217.x.x.30 255.255.255.0
ip address inside 162.18.1.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool localusers 162.18.1.100-162.18.1.150
pdm location 162.18.0.0 255.255.0.0 inside
pdm location 162.18.1.0 255.255.255.0 outside
pdm location 162.18.1.20 255.255.255.255 inside
pdm location 0.0.0.0 255.255.255.255 outside
pdm location 217.x.x.30 255.255.255.255 inside
pdm location 162.18.1.1 255.255.255.255 outside
pdm location 162.18.1.10 255.255.255.255 inside
pdm location 162.x.0.0 255.255.0.0 inside
pdm location 207.183.52.0 255.255.255.224 outside
pdm location 162.18.1.30 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 217.x.x.26 162.18.1.10 netmask 255.255.255.255 0 0
static (inside,outside) 217.x.x.30 162.18.1.20 netmask 255.255.255.255 0 0
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 217.x.x.1 1
route inside 162.18.1.0 255.255.255.0 162.18.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 162.x.x.0 255.255.0.0 inside


Thanks for any help

 

[tonymullen]

these two lines below allow access via ftp to the 217.x.x.30 address and are in the config above.

static (inside,outside) 217.x.x.30 162.18.1.20 netmask 255.255.255.255 0 0

access-list outside permit tcp any host 217.x.x.30 eq ftp

are you trying to give access to an additional server?

You also have two access lists that are not doing anything - access list inside and access list inside_access_in

you need an access-group line to bind these to an interface. although I would be careful as both of these seem to allow any any access.

 

[mbilgrav]

Hold it.

is the IP in this line:
static (inside,outside) 217.x.x.30 162.18.1.20 netmask 255.255.255.255 0 0

The same Ip as your outside interface ?
If that is the case, and you can not use another public IP, you should do PAT instead of NAT.
static (inside,outside) tcp 217.x.x.30 21 162.18.1.20 21 netmask 255.255.255.255 0 0

same goes for the rest of the 4 line in your ACL on outside to that IP.

HTH
Martin

 

[mbilgrav]

that should read:
static (inside,outside) tcp interface 21 162.18.1.20 21 netmask 255.255.255.255 0 0
NOT:
static (inside,outside) tcp 217.x.x.30 21 162.18.1.20 21 netmask 255.255.255.255 0 0


sry - my bad