FTP IN DMZ - ACCESS FROM INSIDE AND OUTSIDE ?

[amarchi]

hI,
I HAVE try with many configuration but no work.
you know if there is a way to put an ftp server in DMZ,
achieve it from outside and from inside ?.
follow my pix 515 partial configuration.
ANy help will be appreciated
thanks in advance
Massimo

PIX Version 6.2(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name 10.10.10.5 mail
name 192.168.254.131 dns_server
name 10.10.10.13 webmail
access-list outside_access_in permit tcp any host 190.180.140.130 eq smtp
access-list outside_access_in permit tcp any host 190.180.140.130 eq pop3
access-list outside_access_in permit udp any host 190.180.140.131 eq domain
access-list outside_access_in permit tcp any host 190.180.140.130 eq ldap
access-list outside_access_in permit tcp any host 190.180.140.130 eq imap4
access-list outside_access_in permit tcp any host 190.180.140.132 eq www
access-list outside_access_in deny ip any any
access-list 101 permit ip 10.10.0.0 255.255.0.0 10.10.0.0 255.255.0.0
pager lines 24
logging console errors
logging monitor warnings
logging buffered errors
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
icmp deny any outside
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 190.180.140.158 255.255.255.0
ip address inside 10.10.10.10 255.255.0.0
ip address dmz 192.168.254.10 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip verify reverse-path interface dmz
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm location mail 255.255.255.255 inside
pdm location 10.10.10.0 255.255.255.0 inside
pdm logging errors 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 2 interface
global (dmz) 1 192.168.254.11
nat (inside) 0 access-list 101
nat (inside) 1 10.10.10.6 255.255.255.255 0 0
nat (inside) 2 0.0.0.0 0.0.0.0 0 0
alias (inside) 190.180.140.131 dns_server 255.255.255.255
static (inside,outside) 190.180.140.130 mail netmask 255.255.255.255 0 50
static (dmz,outside) 190.180.140.131 dns_server netmask 255.255.255.255 0 50
static (inside,outside) 190.180.140.132 webmail netmask 255.255.255.255 0 50
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 190.180.140.129 1

 

[baddos]

Open up TCP ports 20 and 21 to your "outside_access_in" access-list to the IP of the desired FTP server.

 

[amarchi]

Thanks for your answer Baddos
i have try with the following setting but still not work.

static (dmz,outside) 190.180.140.133 192.168.254.133 netmask 255.255.255.255 0 50
access-list outside_access_in permit tcp any host 190.180.140.133 eq ftp

is it only the port 21 for the ftp? why you told me
21 and 20 ?
thanks for your help Baddos

 

[baddos]

If this line:

access-list outside_access_in deny ip any any

is in front of the new access-list entry, the new access-list entry won't work. Make sure your access-list looks like this:

access-list outside_access_in permit tcp any host 190.180.140.130 eq smtp
access-list outside_access_in permit tcp any host 190.180.140.130 eq pop3
access-list outside_access_in permit udp any host 190.180.140.131 eq domain
access-list outside_access_in permit tcp any host 190.180.140.130 eq ldap
access-list outside_access_in permit tcp any host 190.180.140.130 eq imap4
access-list outside_access_in permit tcp any host 190.180.140.132 eq www
access-list outside_access_in permit tcp any host 190.180.140.133 eq ftp
access-list outside_access_in permit tcp any host 190.180.140.133 eq 20
access-list outside_access_in deny ip any any