Workaround for Active FTP (nat to nat)

[Hagfish]

We recently set up our pix firewall and put several servers behind it including a dmz webserver (30.30.30.x) Now that we've done this, one of our customers can no longer get a directory listing on our ftp site as they have passive ftp disabled on their firewall that is also natting their workstations. Is there anything that I can change on my pix configuration that will allow them to get in with Port ftp or are they just going to have to find a way to enable passive ftp on their side? Thanks!

--hag

 

[themut]

Assuming they can connect to the FTP server, all you need on the PIX is make sure "fixup protocol ftp" is enabled. If not, then issue the command:

fixup protocol ftp 21

If your FTP server listens on a non standard port then you need to enable your port with the fixup protcol:

fixup protocol ftp <non-standard port>

 

[Hagfish]

The "fixup protocol ftp 21" is already there. They can connect to the ftp but the directory listing times out because they can't use passive ftp. They're using port. Any other ideas?

 

[themut]

On the PIX all you need are the following statements:

1) ACL allowing traffic on TCP port 21 (it is ok since they can connect).
2) A static translation for the FTP server (it is ok since they can connect).
3) fixup protocol ftp should be enabled (it is there).

The configuration on the PIX sounds good. Looks to me like the problem is on the application and not on the PIX.

 

[Hagfish]

Is it mandatory for clients that are trying to connect through their own firewall to use PASV when connecting to mine? Or is it still possible to use Port.. as it is right now I can only use passive from firewall to firewall ftp. And unfortunately, our client has passive ftp blocked.

 

[valicon]

I have the very same issue. Has there been a solution?

 

[Hagfish]

We ended up having the network admin on the client side make some changes to their router to get it to work.

 

[84112000]

I had the same situation and read other post, the suggested to have "no fixup protocol ftp" worked for me. Give it a try and let us know.