Publish FTP in DMZ - ISA 2004

[cygnetrower1]

Hi

I am having real trouble publishing a FTP server in a DMZ on ISA 2004. Iam trying to use a server publish rule on port 21 using all defaults

I have other servers published via web publishing rules which work ok. I have also tried using a http redirect to ftp, which also works ok but as I want users to use an FTP client this is no good.

Logging shows the Enterprise Default Rule is denying access, so it looks like it does not even read the FTP.

Can anyone hlep ?

 

[coco10]

hi, chek this for help. let me know how its work

http://www.isaserver.org/articles/2004pubdmzservers.html

coco10

 

[cygnetrower1]

I figured it out

I neded to create a network rule to allow traffic out from the DMZ interface. So I created a NAT rule (DMZ to External)

I would have thought ISA could handle this dynamically for FTP ie port 21 in from client and port 20 response from server ! But it doesn't seem to work without it.

 

[Venefyxatu]

Hi,

I'm testing an ISA server setup at the moment, and I ran into the same problem. Would you mind posting a more detailed description of your solution?
What I thought you meant was creating an extra rule to allow traffic over port 20 from the DMZ to the External network, but that doesn't seem to work so I must've misunderstood

Thanks in advance!

Venefyxatu

 

[cygnetrower1]

Hi,

I was lazy and created an "all traffic" rule from the DMZ to external. Once I did this the FTP started to work.

My second comment was really about other Firewalls I have worked with where once an access rule is allowed in bound it's not neccessary to create another outbound as the Firewall takes care of this for you. Cisco PIX does this for instance with the fixup command.

 

[Venefyxatu]

Hi again,

First of all, thanks for the answer. I already had an "all traffic" rule, so unfortunately that didn't work for me.

I did, however, find the problem. I'd used the standard 3-leg perimeter template to configure my networks, but apparently that's broken.
It uses the NAT relation for Perimeter Configuration (ie for traffic going from the internal network to the perimeter network), and the Route relation for Perimeter Access (ie traffic going from the perimeter network to the internet is router by the ISA server).
Switching these two seems to fix everything ... FTP publishing works like a charm now, even without the allow all rule