ftp ports from outside to inside 2

[yowza]

What is the best way to handle allowing ftp access from the outside to a server behind the Pix? I wanted to ftp a file to a server behind the Pix so I created the ACL on the outside interface and was able to log into the server. When I went to get the file, the connection timed out. So I tried it again. When I looked at the logs, I noticed it was trying to send the data via port 1130 the first time and 1131 the second time. So I created another ACL for 1132 and was able to get the file. As you can see, I don't know too much about ftp protocol or the pix for that matter) It seems to me that if you wanted to allow ftp access from the outside to inside you would need to set up some sort of range of ports. I didn't think having a range of unnecessary ports open on the Pix would be a good thing to do.
I would appreciate any explanation, url, article or any other explanation on this. I have spent a couple of hours searching the net for info but haven't really found a good answer.

Thanks,
yowza

 

[bwilliam13]

Use passive mode on your ftp client and this won't happen.

 

[yizhar]

HI.

You are probably using non-standard port for FTP.
If you are using for example port 21212 for FTP, then you'll need this:
access-list ....
fixup protocol ftp 21212

The fixup command instructs the pix to inspect the traffic on that port for FTP commands and open additional ports as needed - on the fly.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/df.htm#1067379

It is also a good idea to protect the FTP access by allowing access only from specific known IP address, or VPN or...
You should also carefully configure permissions on the FTP server and use read-only whenever possible.
An open FTP server is like Open mail relay - it might be used for Warrez or attacks, and hidding it with different port is good idea but is not sufficient protection.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[yowza]

Thanks for the responses. I created ACLs for ports 20 and 21. This is not for a ftp server. I just needed to use it to transfer a few large files. It was only a one time thing. I was going from a W2000 box to a unix, Sun Solaris 8 box.

Thanks again, I appreciate the info.

Yowza

 

[matthew3041]

Understanding the difference in Passive and active FTP will help you create the proper acl. This website explains.

http://slacksite.com/other/ftp.html