ftp in dmz

Hi,

It seems to me that you are not letting the traffic back out of your DMZ.

This ACL says allow traffic from your mail server to your network destined for FTP port. Won't the source port be FTP for the return traffic and thus should read something like:

access-list DMZ1_access_in extended permit tcp host 192.168.60.15 eq ftp

This would be why you are getting timeouts, no return traffic is coming back. Hope this helps.

thank you for your reply.

I thought the same and tried it like this first, with the src port being ftp, but i get the same response and same messages in the log.

K.J. 44 wrote:

snip

It is difficult to see if any other part of your config may be affecting what you are trying to achieve here.

Just out of curiosity - if you have an ASA then you have access to the ASDM software tool. On the GUI you have the option to simulate traffic passing between interfaces based on a number of criteria that you can set - it's very straightforward.

As you run the packet flow simulation the ASA will tell you if the packet will be accepted or rejected on the various criteria - NAT, Access-List etc that you have defined in your config. At the point it fails you can click to find out where it failed making troubleshooting much easier.

HTH.

Regards

Darren

You cannot static the same public IP to two different internal addresses, not unless you add in [different] port restrictions.

Also, if is the same as the outside interface of your ASA (or PIX), then you must use port restrictions.

For the ASA, that would look like,

static (DMZ1,outside) tcp ftp 192.168.60.15 ftp netmask

For PIX 6.3, it would look like,

static (DMZ1,outside) tcp interface ftp 192.168.60.15 ftp netmask 255.255.255.255

You only need to static (inside,DMZ1) if you need DMZ1 to be able to initiate connections to inside (but then why bother with a DMZ?), or if it is important on the DMZ device to be able to figure out exactly which inside device is connecting (e.g., for logs or differential access purposes.)

An access-group applied "in" interface DMZ1 controls the locations that DMZ1 is able to initiate connections to. Unless you need your ftp server to be able to initiate ftp sessions to inside, get rid of that.

Either there is something -very- wrong with your systems or else your log outputs events in reverse chronological order.

Hi Darren,

I have never seen this or used it in the asdm, can you tell me how to get to it? i have looked through the asdm and see nothing of the sort.

Thanks

Darren Green wrote:

thanks for all the help guys...i figured out my issue. something lame...the friggin xp firewall was on preventing me from using ftp..or anything else for that matter.

Walter Robers> >