By default, the global policy used on a Cisco ASA firewall enables FTP inspection for all traffic passing through the appliance. Before discussing the usage of ftp inspection, let’s see how ftp works:
In Active FTP (which is the default mode), we need two ports for communication. Port 21 is used for Command and Control traffic and Port 20 is used for Data transfer. The FTP client connects from a random source port bigger than 1023 (N>1023) to the command port of the FTP server (port 21). Then the client starts listening to port N+1 and notifies the server that it will accept data to this port (N+1). The server then connects back to the specified data port of the client from its local data source port 20.
Now, the above behavior works fine if there is no firewall between the FTP client and server. However, if there is a stateful firewall between the two ftp nodes, we have a problem. Specifically, when the FTP server will start its Data connection back to the client (in order to start sending traffic), the firewall will block this data communication because it will start from a different source port (20 instead of 21). The purpose therefore of the inspect ftp command on the Cisco ASA is to listen for the initial Command FTP traffic (on port 21) and dynamically open a secondary Data connection between FTP server and client (from port 20). This will allow FTP communication to work. If you disable FTP inspection with the no inspect ftp command, outbound users can start connections only in passive mode, and all inbound FTP is disabled.
The inspect ftp command is found under the global policy map:
policy-map global_policy
class inspection_default
inspect ftp
Related Posts
- Prevent Spoofing Attacks on Cisco ASA using RPF
- Configuring Connection Limits on Cisco ASA Firewalls – Protect from DoS
- Configuring AAA Authentication-Authorization-Accounting on Cisco ASA Firewall (TACACS+, RADIUS)
- Cisco ASA Firewall Management Interface Configuration (with Example)
- How to Configure Access Control Lists on a Cisco ASA 5500/5500-X Firewall (with Examples)