2

Has anyone configured Active FTP in Meraki? If so, will you please assist me with how to configure it on an MX100?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 3:42
2

Cisco maintains documentation for this type of thing. It takes about 2 seconds to locate the specific document on how to do this. Active and Passive FTP Overview and Configuration:

Active FTP Overview

An active FTP session involves the following steps:

  1. The client sends the PORT command to an FTP server. The source port is a random, high-numbered port. The destination port is 21.
  2. The server responds with an ACK.
  3. The server initiates a connection to the client with source port 20 and the destination port specified in the client’s PORT command.
  4. The client sends an ACK to the server. The FTP session has now been established. Client firewalls are often configured to block incoming connections. This causes step 3 of the above process to fail, as shown below: enter image description here

MX Configuration for Active FTP

Configuration for active FTP on an MX appliance is a simple process. Firewall rules must be constructed to allow inbound connections on port 21 and 20. Additional information about constructing firewall rules can be found here, and the following example below details a 1:1 NAT rule that allows inbound connections to an internal FTP server.

enter image description here

By default, MX appliances allow all outbound connections, so no additional firewall configuration is necessary. The following diagram outlines the flow of active FTP traffic, and where the MX comes into play: enter image description here

2

Just to add to this, client outbound active FTP (Ron's first picture) is not supported as of December 2016 without installing beta firmware on the Meraki MX appliances. Check the first note on the Meraki documentation:

https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Active_and_Passive_FTP_Overview_and_Configuration

This is because Meraki MX does not ship with a FTP inspection engine like other vendors for client FTP sessions. There is a beta firmware available to correct this, have to open a Meraki TAC case to have it pushed down for upgrade.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.