Active ftp

Hi Nadeem,

 

 

Do you have a virtual server defined to pass this traffic or is it going through a default SNAT? Have you tried searching for "active FTP" on AskF5.com?

 

 

Aaron

i think this's the one Aaron mentioned.

 

 

sol8021: Configuring the BIG-IP LTM to allow outbound FTP sessions

 

http://support.f5.com/kb/en-us/solutions/public/8000/000/sol8021.html

 

 

cheer!

I created virtual server for my outboud ftp site and follow the instruction from SOL8021 but still having issue. I also found SOL6557 but both solution did not help my active ftp issue.

this is mine.

[root@camellia:Active] config  b version|grep -iA 1 version
BIG-IP Version 10.2.0 1707.0
Final Edition
[root@camellia:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination any:ftp
   mask 0.0.0.0
   ip protocol tcp
   profiles {
      ftp {}
      tcp {}
   }
}
[root@camellia:Active] config  b pool foo list
pool foo {
   members 172.28.17.254:any {}
}

 ftp 172.28.26.70
Connected to 172.28.26.70 (172.28.26.70).
220 (vsFTPd 2.0.6)
Name (172.28.26.70:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode off.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxrwxrwx    4 1001     1001         4096 May 12  2010 F5
drwxr-xr-x    6 1000     1001         4096 Nov 15  2009 Software
drwxr-xr-x    2 1000     1000         4096 Apr 11 09:22 build
drwxr-xr-x   10 1000     1001         4096 Jul 14  2009 esxitemplate
drwxr-xr-x   13 1000     1001         4096 Apr 08 18:07 f5ftpmirror
drwxr-x--x    4 1000     1001         4096 Jun 07  2010 hotfixmirror
drwxrwxrwx    7 1001     1001         4096 May 17 02:33 tmp
226 Directory send OK.

] netstat -tan|grep 172.28.26.70
tcp   100896      0 10.10.70.110:4861       172.28.26.70:20         ESTABLISHED
tcp        0      0 10.10.70.110:2791       172.28.26.70:21         ESTABLISHED

is there anything i missed?

have u run tcpdump? isn't it helpful?

tcpdump -nni 0.0:nnn -s0 -w host or host

cheer!

don't know why config wasn't shown. put it again here.

 

 

[root@camellia:Active] config b version|grep -iA 1 version

 

BIG-IP Version 10.2.0 1707.0

 

Final Edition

 

[root@camellia:Active] config b virtual bar list

 

virtual bar {

 

snat automap

 

pool foo

 

destination any:ftp

 

mask 0.0.0.0

 

ip protocol tcp

 

profiles {

 

ftp {}

 

tcp {}

 

}

 

}

 

[root@camellia:Active] config b pool foo list

 

pool foo {

 

members 172.28.17.254:any {}

 

}

 

 

 

ftp 172.28.26.70

 

Connected to 172.28.26.70 (172.28.26.70).

 

220 (vsFTPd 2.0.6)

 

Name (172.28.26.70:root): anonymous

 

331 Please specify the password.

 

Password:

 

230 Login successful.

 

Remote system type is UNIX.

 

Using binary mode to transfer files.

 

ftp> passive

 

Passive mode off.

 

ftp> ls

 

200 PORT command successful. Consider using PASV.

 

150 Here comes the directory listing.

 

drwxrwxrwx 4 1001 1001 4096 May 12 2010 F5

 

drwxr-xr-x 6 1000 1001 4096 Nov 15 2009 Software

 

drwxr-xr-x 2 1000 1000 4096 Apr 11 09:22 build

 

drwxr-xr-x 10 1000 1001 4096 Jul 14 2009 esxitemplate

 

drwxr-xr-x 13 1000 1001 4096 Apr 08 18:07 f5ftpmirror

 

drwxr-x--x 4 1000 1001 4096 Jun 07 2010 hotfixmirror

 

drwxrwxrwx 7 1001 1001 4096 May 17 02:33 tmp

 

226 Directory send OK.

 

 

netstat -tan|grep 172.28.26.70

 

tcp 100896 0 10.10.70.110:4861 172.28.26.70:20 ESTABLISHED

 

tcp 0 0 10.10.70.110:2791 172.28.26.70:21 ESTABLISHED

 

 

tcpdump command:

 

tcpdump -nni 0.0:nnn -s0 -w output_file host ftp_server_ip

 

 

hth

I ran many tcpdump and found that I get connect but when ftp request for directory listing it keep retrying.

 

Response: 200 command okey, after this line I see retries and fail. It only heppen when I use active ftp, my passive ftp work fine.

 

 

 

is there any suspicious while connection keeps retrying e.g. src port, dst port, seq number?

 

 

is it possible to try another ftp server e.g. another ftp software?

I found the problem, I have Cisco ASA5585 and running 8.4(1), it is cisco IOS bug [ CSCto09465 FTP transfers fail with NAT configured on multi-core ASAs (5580/5585)] This problem is fixed in new IOS asa841-13-smp-k8.bin.

thanks for info!