Age old passive FTP questions

Just realized I posted this in discussions vs questions. Re-posting

 

This has probably been beaten down enough at this point, but I can't seem to find the answer anywhere. Here is the setup:

 

FTP server: just an ubuntu vsftpd server listening on port 21 and passive data ports set to a range 10090-10100. this is working as expected (prior to introducing F5) Virtual Server: listening on port 21 w/ default tcp profile and custom FTP profile with data port set to 0. Member is FTP server port 21. Passive FTP also works through this virtual server just fine. Here is my issue. When my FTP server responds with the passive port to use, let's say 10100, the F5 translates that port within the packet to a random ephemeral port. The client does as it's told and transfers the data over that random port, F5 handles the port translation back to port 10100 for my FTP server on the back end and everything works fine, but my problem is I need the client to connect to the actual port presented within the FTP passive response from my FTP server for firewall access-list reasons.

 

I've tried the following: - disabled port translation on the virtual server - turned off CMP for that virtual server (found an article that referenced this possibly causing the issue) - changed the member from ip.addr:21 to ip.addr:0 (didn;t think that would do it but tried just for the hell of it) - changed the custom FTP profile to a specific data port of 10100 and set my ftp server to only use port 10100 as the passive FTP port

 

In each case, the F5 still changes that passive port to another port when sending the response packet to the client.

 

I have pcaps that show exactly what is happening and can reproduce every time. Anyone that has any insight into this I would be GREATLY appreciative. Thanks all

 

-GR

 

Reply to this Discussion 0 Rate this Discussion