Home / server / Questions / 135169
In Process
sam
Asked: 2010-04-23 23:16:23 +0800 CST

FTP in DMZ, TCP Ports for LDAP Auth

  • 772

szenario:

(outside)---(ASA5510)---(inside) ->Windows2008 DC

.....................(dmz)

..........->Win2008 FTP Server

Which Ports do I need to open from DMZ->Inside that FTP Users can authentificated on the Inside DC?

I have allready opend 389 (Ldap), 636 (secure Ldap) and 53 (dns). But the ftp Client stucks allways after processing the credentials and the FTP Server gives you an eventlog "logon error". the error messages indicates that there could be an issue with closed ports.

if I turn the ACL to "IP", that means all ports are open, everything is working fine.

ftp ldap port dmz cisco-asa

1 Answers

  1. FTP uses two different TCP ports. Port 21 for ftp commands and port 20 for ftp data.

    With only port 21 allowed through the firewall you would need to use a passive ftp connection.

    You can switch to passive mode in the Microsoft command line ftp client by issuing the following command after login:

    ftp> QUOTE PASV

    You should receive a 227 response to the effect of "Entering Passive Mode".

    At this point you should be able to continue unfettered.

    • 0