Re: Port 990 - ACL problems - PIX

On Aug 3, 10:45 am, p...@xxxxxxxxxxxxxx wrote:
Having some issues with a Cisco PIX IOS 7

we've put an FTP server in our DMZ and normal FTP access seems to be
working but when we want the client to connect over 990 it doesn't
seem to work, however if i connect from another machine on the DMZ
it's all fine.

The relevant bits of the config are shown below:

ftp mode passive
access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ftp
access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ssh
access-list out-acl extended permit tcp any host xx.xx.xx.23 eq 990
access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ftp-
data
access-list out-acl extended permit udp any host xx.xx.xx.23 eq 990
static (DMZ,outside) xx.xx.xx.23 192.168.yy.4 netmask 255.255.255.255
access-group out-acl in interface outside

There isn't currently an access list defined for the DMZ interface,
should i add one and specifically permit 990 out?

Are the client connections which are failing to the DMZ server on port
990 originating from the Outside interface as well and therefore
being inspected by access-list out-acl?
.

Relevant Pages

  • Port 990 - ACL problems - PIX
    ... we've put an FTP server in our DMZ and normal FTP access seems to be ... however if i connect from another machine on the DMZ ... access-list out-acl extended permit tcp any host xx.xx.xx.23 eq ftp ...
    (comp.dcom.sys.cisco)
  • Re: FTP server in DMZ and authentication to/from internal AD
    ... Authentication in a DMZ is just one of those problems with no simple answer: ... staging folder on internal domain, copied as a task up to the DMZ folder ... DMZ proxy that publishes your internal folder over FTP ... we have to change the local account on the FTP server ...
    (microsoft.public.windows.server.active_directory)
  • Re: auto file transfer to a dmz
    ... Would it be difficult to script an ftp ... >> One of my clients would like to setup a computer in a dmz that can ... > a) the user manually updates the DMZ copy when they change an original. ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: securing an FTP service
    ... > moving the ftproot folder to another server INSIDE the DMZ ... > that FTP passwords are transmitted not enchrypted? ... VPN is a solution, maybe FTP over SSL is another (but I am not ...
    (Security-Basics)
  • Re: auto file transfer to a dmz
    ... you could script it with native windows FTP and use windows scheduler to run ... "Joe Letter" wrote in message ... >>> One of my clients would like to setup a computer in a dmz that can ... >> a) the user manually updates the DMZ copy when they change an original. ...
    (microsoft.public.backoffice.smallbiz2000)