ftp problem - ok on port 99 but not on 21

[Hfnet]

We have had a server 2003 system running Filezilla Server quite happily until today. We had a Pix 501 firewall on the domain IP range (10.0.0.xxx) but had some issues which meant we had to move it onto a WAN port on the server and onto a different IP range (192.168.2.xxx).

Since then, we can start an ftp session but is disconnects on entering pasv mode. If I change Filezilla server to listen on port 99 it works fine.

Can anyone suggest a reason for it not working on 21 when it did before?

 

[F1lby]

Starting an FTP session from where? A machine on the same network? The other side of the Pix?

Can you connect to the FTP server on the actual machine itself (i.e. connecting from itself... to itself..) Does that work?

I don't know what you mean by a WAN port on the server.... Another Ethernet port?

We need to understand your network topology more thoroughly (i.e. need a map of your network).

Rgds

Phil B

 

[Hfnet]

Trying externally, of course. You cannot browse to an external IP from inside because the Pix cannot route like that.

We have Router -> PIX -> Server01 WAN (NIC with 192.168.2.2 IP)

The server also has a LAN (NIC with 10.0.0.2 IP) so all routing goes outwards through server01 and out through the WAN port (We call them WAN and LAN to differentiate easily)

Routing inwards is controlled by the PIX. The router has our public Gateway IP with no rules, the PIX has a public interface of 1 IP higher than the gateway. The PIX has an internal IP of 192.168.2.1 and has translation rules for https, smtp, pptp, gre and ftp (in this case also a tcp rule for 99) which all route to the server01 WAN port.

The setup was the same effectively when the PIX was on the local network, just with a different internal IP and routed directly to 10.0.0.2 and the ftp worked fine. Now it almost looks like something is being blocked as it cannot connect fully, but the server WAN has no firewall and RRAS is not configured for a firewall either.

Hope this is enough information...

 

[F1lby]

Can you FTP to the server from the server itself?
i.e. Can you prove FTP is actually working on the server by connecting from the server.. to the server?

We need to ascertain whether FTP is actually working on port 21. Assuming we can prove it is[/] working then we can work along the chain until it stops working.

Can you FTP from the PIX to the FTP server? You could prove this by using copy running-config ftp . This would allow you to copy your running config on to the ftp server and prove ftp is working.

You have translation rules on the Pix. Any ACLs that might be blocking 21?

 

[Hfnet]

Yes, like I said it was working fine on 21 until we changed IP addresses. The server is working fine if ftp'ing internally and from itself.

No special rules/ACLs, there is no abnormal setup here, just a basic vpn, email, browsing, ftp setup. All we did was change the internal IP and translation rule IP for server01, the rules remain as they were.

If you ftp from outside it connects, negotiates then falls over, so it's almost like a routing issue. We have enabled tcp 50000 - 50100 and specified this range in the ftp server.

 

[Hfnet]

Forgot to say, I'll try the running-config idea and post results.

 

[F1lby]

FTP inspection may possibly help

FTP is a tricky protocol to get going.

I've enabled ftp inspection our ASA's.

Here's a chunk of the configs on one of our ASA's....


class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect tftp
inspect icmp

 

[bTkalternate]

Well if the connection drops when it switches to passive mode then this is almost always a firewall/routing issue.

FTP PASV will allow the client to connect on port 99 but will then initiate its own connection back to the client running on high ports (1024 and above).
Normally in the FTP server you can specify which port ranges to use for PASV and then configure your firewall/ACL as needed.

Try testing it from the following site and note the details

http://www.g6ftpserver.com/en/ftptest

Also I suggest you read the following and make sure its configured as needed.

http://wiki.filezilla-project.org/Network_Configuration

http://wiki.filezilla-project.org/Network_Configuration#Passive_mode_2

Perhaps look past the fact it works on port 21 as that may have special settings already set on the device due to it being the standard ftp port.

Let us know how you get on.