F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

PInkFloyd's avatar
PInkFloyd
Icon for Nimbostratus rankNimbostratus
Mar 23, 2021

Passive FTP using FTP profile

Hi Community,   I have an F5 Big-IP 16.0.1.1 running on AWS with a FTP server behind running vsftpd. The idea is balance passive ftp publically. So, clients should hit public IP of the F5 for pa...
aws
BIG-IP
cloud
ftp
passive
profile
security
Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Mar 24, 2021

I checked this further and I cannot find any difference. I checked if I missed something in my vsftpd.conf... nope.

Your VS config seems OK, too. Can you check for the destination 0.0.0.0:0 (any) and the iRule? That seems off....

In my Wireshark capture it looks like this:

vsftp server ----> floating self-IP >> ftp.passive.ip==<IP address of the vsftp server>
virtual server ----> client >> ftp.passive.ip==<IP address of the F5 virtual>

So the value for ftp.passive.ip get's updated and replaced properly.

I tried with FileZilla and WinSCP, no special config required there either. Just works.

Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
Mar 25, 2021

D'oh! My head just crashed on my desk. I missed the obvious because I didn't pay attention to the specifics of AWS. Yes... totally makes sense.

 

I am not even sure if having a second interface would help solve the issue, because the virtual IP is always a private IP address. The NAT is done outside the BIG-IP, in AWS, as far as I know. The whatever address the ftp profile would add ? replace, it would not be the public IP.

Also I don't see a way to work around this with an iRule.