Port 990 - ACL problems - PIX

- P
- paul
  
  Contact options for registered users
posted
14 years ago

Mon, Aug 3, 2009 3:45 PM

Having some issues with a Cisco PIX IOS 7

we've put an FTP server in our DMZ and normal FTP access seems to be working but when we want the client to connect over 990 it doesn't seem to work, however if i connect from another machine on the DMZ it's all fine.

The relevant bits of the config are shown below:

ftp mode passive access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ftp access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ssh access-list out-acl extended permit tcp any host xx.xx.xx.23 eq 990 access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ftp- data access-list out-acl extended permit udp any host xx.xx.xx.23 eq 990 static (DMZ,outside) xx.xx.xx.23 192.168.yy.4 netmask 255.255.255.255 access-group out-acl in interface outside

There isn't currently an access list defined for the DMZ interface, should i add one and specifically permit 990 out?

Loading thread data ...

- J
- jrguent
  
  Contact options for registered users
Vote on answer
posted
14 years ago

Tue, Aug 4, 2009 4:45 PM

Are the client connections which are failing to the DMZ server on port

990 originating from the Outside interface as well and therefore being inspected by access-list out-acl?

- J
- jcle
  
  Contact options for registered users
Vote on answer
posted
14 years ago

Tue, Aug 4, 2009 6:41 PM

Are you sure it isn't TCP 990 instead of UDP 990..

Also orginate these connections from the outside interface as the prev post suggested.

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.