Skip to main content
Network Engineering

Return to Answer

added 117 characters in body
Source Link
generalnetworkerror
generalnetworkerror
  • 7.1k
  • 6
  • 33
  • 66

Since your comment indicated the client is on the outside and the server sitting inside, the outside client would be initiating a connection to your inside server. Therefore, your firewall must have an ACL on your outside interface to permit this, but this is just the beginning of the story....

FTP

FTP

FTP has a control channelcontrol channel on port 21 and a data channeldata channel on port 20 by default, but the data channel is usually some random port negotiated over the control channel. With a firewall like the Cisco ASA or PIX, you typically need FTP Inspection enabled. Your Outside ACL only allows tcp/21. The Inspection occurs at the FTP app layer so the firewall can detect the port for the data channel and create a pinhole for that traffic.

The data transfers take place on the data channel in either Active (usually default) or Passive mode as determined by the client. [Active mode was once the predominant default, but many clients are moving to Passive now.] Active mode (FTP PORTPORT command) indicates the port (and IP address) the client is listening for the incoming data connection to be initiated by the server. This often breaks because client firewalls are often not often capable of the Inspection-equivalency to let that through. So often, we see clients doing Passive mode (FTP PASVPASV command) which asks the server to provide a port that the client will connect to (server listening on PASV port).

Without Inspection or its equivalent on your firewall, you'll need to open blocks of ports if clients are Passive and restrict your server to a small range of data channel ports. Keeping the number of ports low prevents you from opening too many ports on your Outside ACL. With Active clients and no Inspection, a default permit inside any any type of statement would let your server initiate a connection out to the client on the data channel, though you may still run into the client's firewall getting in the way as described earlier.

SFTP

SFTP

This is just Secure (or SSH) FTP which is really just SSH file transfers and not the FTP protocol itself. It defaults to tcp/22 -- same as SSH -- and doesn't require a separate channel. This is much easier to handle through firewalls, but obviously both client and server need to be speaking the same protocol.

Since your comment indicated the client is on the outside and the server sitting inside, the outside client would be initiating a connection to your inside server. Therefore, your firewall must have an ACL on your outside interface to permit this, but this is just the beginning of the story....

FTP

FTP has a control channel on port 21 and a data channel on port 20 by default, but the data channel is usually some random port negotiated. With a firewall like the Cisco ASA or PIX, you typically need FTP Inspection enabled. Your Outside ACL only allows tcp/21. The Inspection occurs at the FTP app layer so the firewall can detect the port for the data channel and create a pinhole for that traffic.

The data transfers take place on the data channel in either Active (usually default) or Passive mode as determined by the client. Active mode (FTP PORT command) indicates the port (and IP address) the client is listening for the data connection to be initiated by the server. This often breaks because client firewalls are often not capable of the Inspection-equivalency to let that through. So often, we see clients doing Passive mode (FTP PASV command) which asks the server to provide a port that the client will connect to (server listening on PASV port).

Without Inspection or its equivalent on your firewall, you'll need to open blocks of ports if clients are Passive and restrict your server to a small range of data channel ports. Keeping the number of ports low prevents you from opening too many ports on your Outside ACL. With Active clients and no Inspection, a default permit inside any any type of statement would let your server initiate a connection out to the client on the data channel, though you may still run into the client's firewall getting in the way as described earlier.

SFTP

This is just Secure (or SSH) FTP which is really just SSH file transfers and not the FTP protocol itself. It defaults to tcp/22 -- same as SSH -- and doesn't require a separate channel. This is much easier to handle through firewalls, but obviously both client and server need to be speaking the same protocol.

Since your comment indicated the client is on the outside and the server sitting inside, the outside client would be initiating a connection to your inside server. Therefore, your firewall must have an ACL on your outside interface to permit this, but this is just the beginning of the story....

FTP

FTP has a control channel on port 21 and a data channel on port 20 by default, but the data channel is usually some random port negotiated over the control channel. With a firewall like the Cisco ASA or PIX, you typically need FTP Inspection enabled. Your Outside ACL only allows tcp/21. The Inspection occurs at the FTP app layer so the firewall can detect the port for the data channel and create a pinhole for that traffic.

The data transfers take place on the data channel in either Active or Passive mode as determined by the client. [Active mode was once the predominant default, but many clients are moving to Passive now.] Active mode (FTP PORT command) indicates the port (and IP address) the client is listening for the incoming data connection initiated by the server. This often breaks because client firewalls are not often capable of the Inspection-equivalency to let that through. So often, we see clients doing Passive mode (FTP PASV command) which asks the server to provide a port that the client will connect to (server listening on PASV port).

Without Inspection or its equivalent on your firewall, you'll need to open blocks of ports if clients are Passive and restrict your server to a small range of data channel ports. Keeping the number of ports low prevents you from opening too many ports on your Outside ACL. With Active clients and no Inspection, a default permit inside any any type of statement would let your server initiate a connection out to the client on the data channel, though you may still run into the client's firewall getting in the way as described earlier.

SFTP

This is just Secure (or SSH) FTP which is really just SSH file transfers and not the FTP protocol itself. It defaults to tcp/22 -- same as SSH -- and doesn't require a separate channel. This is much easier to handle through firewalls, but obviously both client and server need to be speaking the same protocol.

Source Link
generalnetworkerror
generalnetworkerror
  • 7.1k
  • 6
  • 33
  • 66

Since your comment indicated the client is on the outside and the server sitting inside, the outside client would be initiating a connection to your inside server. Therefore, your firewall must have an ACL on your outside interface to permit this, but this is just the beginning of the story....

FTP

FTP has a control channel on port 21 and a data channel on port 20 by default, but the data channel is usually some random port negotiated. With a firewall like the Cisco ASA or PIX, you typically need FTP Inspection enabled. Your Outside ACL only allows tcp/21. The Inspection occurs at the FTP app layer so the firewall can detect the port for the data channel and create a pinhole for that traffic.

The data transfers take place on the data channel in either Active (usually default) or Passive mode as determined by the client. Active mode (FTP PORT command) indicates the port (and IP address) the client is listening for the data connection to be initiated by the server. This often breaks because client firewalls are often not capable of the Inspection-equivalency to let that through. So often, we see clients doing Passive mode (FTP PASV command) which asks the server to provide a port that the client will connect to (server listening on PASV port).

Without Inspection or its equivalent on your firewall, you'll need to open blocks of ports if clients are Passive and restrict your server to a small range of data channel ports. Keeping the number of ports low prevents you from opening too many ports on your Outside ACL. With Active clients and no Inspection, a default permit inside any any type of statement would let your server initiate a connection out to the client on the data channel, though you may still run into the client's firewall getting in the way as described earlier.

SFTP

This is just Secure (or SSH) FTP which is really just SSH file transfers and not the FTP protocol itself. It defaults to tcp/22 -- same as SSH -- and doesn't require a separate channel. This is much easier to handle through firewalls, but obviously both client and server need to be speaking the same protocol.