FTP problems

[Jobos]

Our router has recently been reconfigured to block port 21 inbound as we are running an application which FTP’s a file to the server and we didn’t want public access on our system.

 

So far so good, but now we are unable to FTP out. I have spoken to our ISP who configured the router and they said this will happen if port 21 is blocked inbound because of a handshake between the two machines. Now I don’t know anything about Cisco routers but in the ISDN days I used to manage a 3Com router and we never had problems like this. I can’t remember the rules we used but it was something with the keyword ESTABLISHED that only allowed inbound traffic when an outbound connection had been established. Am I dreaming or is our ISP pulling a fast one?

[Joedetic]

Hmmm. With extended ACLs you should be able to setup what you're after.

 

I've not had to play with ACLs for a couple of months now but i'm sure you can do it. The Cisco IOS is pretty flexible like that.

 

Unless of course there's something i'm missing to do with the FTP protocol

[kylewilliamson]

you should be able to use 'passive' ftp with most servers now

[Jobos]

After monitoring the connection with a protocol analyzer and comparing the results with a working school I’m under know doubts that the firewall has been misconfigured as the results show that we are sending out SYN packets but not receiving the ACK packets.

 

In the test the SYN packets were sent from port 1108 to destination port 21. The ACK packets should return back to port 1108. No packets were received back which shows the FTP server didn’t receive the SYN packets i.e. port 21 is blocked outbound.

[Joedetic]

Ask them whether they're using standard or extended ACLs. It maybe that they're just being lazy and not bothering to work out the more complicated ACL that does what you want as opposed to spening an extra couple of minutes working out the extended ACL.

[Jobos]

It turns out there were two entries in access list 102 outbound and one of them was dropping established ftp sessions.

[Joedetic]

Extended ACLs are awkward...take some testing and checking. Glad it's sorted