Loading...
Loading...
FTP Client able to connect to the FTP server, however unavailable to list the directory from the FTP server.
- FTD with dual ISP scenario, with floating default route configured and preferred are configured as the following example: route outside 0.0.0.0 0.0.0.0 10 route backup 0.0.0.0 0.0.0.0 100 - FTP Server on inside interface (or any internal network). - Active FTP mode transfer. - Client reaching the FTD on the backup interface - FTP Server NATed on the backup interface, example: FTP-Server-Real host 192.168.10.20 nat (inside,backup) static FTP-Server-Mapped service tcp ftp ftp FTP-Server-Mapped host
Configure a similar manual NAT as the following NAT: nat (backup,Inside) source dynamic any interface destination static FTP-Server-Mapped FTP-Server-Real Where: FTP-Server-Real host 192.168.10.20 FTP-Server-Mapped host With the NAT above, the SYN from the DATA FTP Channel will be forwarded over the "backup" interface instead of "outside" interface.
When Active FTP transfer is negotiated between client and server, the Data channel is initiated by the Server, this means on an FTD a new connection to be created. Active FTP Transfer is seen as follows ===========Control Channel=========== Client [n TCP port] -----> [port 21] Server ===========Data Channel=========== Client [n+1 TCP port] <----- [port 20] Server Where n is an ephemeral TCP port as the connection is initiated by the Client. This secondary TCP connection (Data channel) on the FTD should be forwarded through the same interface where the Control channel is initiated, however, on FTD it has been seen that the SYN is sent over the outside interface (primary link) instead of the backup interface (secondary link) causing the Client to discard the connection as the source IP from the Data channel from the SYN is different as the destination IP from Control's SYN.
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.