ftp problem

[nikko6]

Hi,

Our company just added a cisco 2801 router. before we added the router, ftp clients were able to type ftp commands via command prompt to our ftp server with passive mode enabled.With the 2801's they cannot do a list directory (ls) command. Comes back with 425 Can't open data connection, but able to successfully list directories via a GUI ftp client. We need to use command prompt for ftp connections. Does anyone have any idea why a GUI ftp client is able to do a list directory (ls), but using command prompt for ftp conections we cannot.

Thanks in advance

 

[burtsbees]

First off, what kind of ftp server? Second, post a config of the router.

Burt

 

[eliotB]

Yes, as burt said post your config.

probably an access list issue. FTP is weird with source and destination ports.

In passive mode, the FTP server responds w/a port greater than 1023. It's random.

An ACL for FTP looks something like this, where 192.168.1.100 is the IP of the FTP server. Also check and see which port FTP is using. I think the default for the ACL of "ftp" is port 21. So if your FTP connections are port 20, than you'd have to eq that to 20 instead. The gt in the ACL means Greater Than.

interface localinside
ip access-group 100 in
!
access-list 100 permit tcp any host 192.168.1.100 eq ftp
access-list 100 permit tcp any host 192.168.1.100 gt 1024
!
interface localoutside
ip access-group 101 in
!
access-list 101 permit host 192.168.1.100 eq ftp any established
access-list 101 permit host 192.168.1.100 gt 1024 any established

http://www.cisco.com/en/US/tech/tk6...tion_example09186a0080100548.shtml#passiveftp

Now, if you currently don't have any ACLs or firewall rules, than it's a totally different problem.

 

[plshlpme]

if the client uses an active connection instead of a passive does it work?

 

[sogol]

Hi there,

I have 2 LANs with 2 cisco routers which are connected to each other.
Router 1 gives Internet to Router 2 and its LAN.
The problem is even though there is no ACL defined,I can not Remote Desktop from LAN1 to LAN2,I can not connect to the HTTP pages of the computers of LAN2 either.No ACL defined and there is no restriction,The remote desktop is enable on both side's computers and the computers can ping each other.

Can you please tell me what can be the problem?
What should I do??

I appreciate your help.

Sogol

 

[Minue]

Hello
What's Router and IOS train was in use before the 2801?Did you mirror the exact config of the old Router.If you have move from IOS 12.2 to maybe 12.4,it could be some new feature that's blocking the ls command.
Regards

 

[nikko6]

Thank you all for your response. I decided to isolate the ftp connection from our existing setup by dropping in a 501 pix firewall and a different router and rerouting it until I figure this out. Again Thanks

 

[burtsbees]

Can you post the config???

Burt