From: ccie2be (ccie2be@nyc.rr.com)
Date: Mon Jun 20 2005 - 18:31:55 GMT-3
Hey John,
Recently (within the past 2 or 3 weeks), I went over this issue with Bob
Sinclair.
For both active and passive, you can use nbar ie match prot ftp.
If you want to use an acl for active, you can use "eq ftp" and "eq
ftp-data".
For passive FTP, you're out of luck suing an acl for the data connection.
HTH, Tim
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of John
Matus
Sent: Monday, June 20, 2005 5:16 PM
To: ccielab@groupstudy.com
Subject: filtering active mode vs. passive mode ftp
i'm a bit confused how you would filter active ftp vs. passive ftp. both
sessions initate on the servers port 21 so i can see how you could filter
with w/:
access-l 100 deny tcp host 1.1.1.1 host 1.1.1.2 eq ftp
but when you get to the data part of the session it seems that you would
only be able to block active mode ftp with:
access-l 100 deny tcp host 1.1.1.1 host 1.1.1.2 eq ftp-data where the port
is 20. is this correct? is there another way to block passive mode ftp?
i suppose you could just block port 21 in either scenarion and that would
stop the command portion of the session so the data would be a mute point.
This archive was generated by hypermail 2.1.4 : Wed Jul 06 2005 - 14:43:42 GMT-3