Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 26 subscribers
  • Views 11052 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

FTP Data Denied

ViciousMagician1116

Trying to setup a new FTP server in our DMZ.  Im almost there I think but I can't figure out how to do it.  I have a business rule setup to send port 20-21 to my server in the DMZ.  I can connect to it from the outside but it wont send the data meaning no file list.  In the log I can see that its denied by the same rule ID i have setup to send port 20-21.

 
Invalid Traffic
Denied
-
9
-
-
XG IP :TCP(21)
Outside IP :TCP(64979)
Business
01001

I have tried a ton of rule combinations but havn't been able to figure it out yet. 



This thread was automatically locked due to age.
Parents
  • 0

    Vicious,

    Can you use drop-packet-capture "host x.x.x.x" from console and post the logs?

    As x.x.x.x put your FTP server.

    I suspect that FTP bounce prevention is denying the traffic.

    Regards

  • 0 in reply to lferrara

    console> drop-packet-capture "host FTP.IP"                                
    2017-06-15 08:29:47 0102021 IP FTP.IP.21 > Outside.IP.56517 : proto TC
    P: P 219144461:219144511(50) win 256 checksum : 36130                           
    0x0000:  4500 005a 1f6e 4000 7f06 c3ca c748 5518  E..Z.n@......HU.              
    0x0010:  629d 9967 0015 dcc5 0d0f e10d 1288 9209  b..g............              
    0x0020:  5018 0100 8d22 0000 3232 3720 456e 7465  P...."..227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3234 342c 3139 3829 0d0a                 244,198)..                    
    Date=2017-06-15 Time=08:29:47 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56517 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2665616256 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:29:48 0102021 IP FTP.IP.21 > Outside.IP.56517 : proto TC
    P: P 219144461:219144511(50) win 256 checksum : 36130                           
    0x0000:  4500 005a 1f70 4000 7f06 c3c8 c748 5518  E..Z.p@......HU.              
    0x0010:  629d 9967 0015 dcc5 0d0f e10d 1288 9209  b..g............              
    0x0020:  5018 0100 8d22 0000 3232 3720 456e 7465  P...."..227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3234 342c 3139 3829 0d0a                 244,198)..                    
    Date=2017-06-15 Time=08:29:48 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56517 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2665616256 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:29:48 0102021 IP FTP.IP.21 > Outside.IP.56517 : proto TC
    P: P 219144461:219144511(50) win 256 checksum : 36130                           
    0x0000:  4500 005a 1f71 4000 7f06 c3c7 c748 5518  E..Z.q@......HU.              
    0x0010:  629d 9967 0015 dcc5 0d0f e10d 1288 9209  b..g............              
    0x0020:  5018 0100 8d22 0000 3232 3720 456e 7465  P...."..227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3234 342c 3139 3829 0d0a                 244,198)..                    
    Date=2017-06-15 Time=08:29:48 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56517 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2665616256 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:29:49 0102021 IP FTP.IP.21 > Outside.IP.56517 : proto TC
    P: P 219144461:219144511(50) win 256 checksum : 36130                           
    0x0000:  4500 005a 1f72 4000 7f06 c3c6 c748 5518  E..Z.r@......HU.              
    0x0010:  629d 9967 0015 dcc5 0d0f e10d 1288 9209  b..g............              
    0x0020:  5018 0100 8d22 0000 3232 3720 456e 7465  P...."..227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3234 342c 3139 3829 0d0a                 244,198)..                    
    Date=2017-06-15 Time=08:29:49 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56517 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2665616256 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:29:52 0102021 IP FTP.IP.21 > Outside.IP.56517 : proto TC
    P: P 219144461:219144511(50) win 256 checksum : 36130                           
    0x0000:  4500 005a 1f73 4000 7f06 c3c5 c748 5518  E..Z.s@......HU.              
    0x0010:  629d 9967 0015 dcc5 0d0f e10d 1288 9209  b..g............              
    0x0020:  5018 0100 8d22 0000 3232 3720 456e 7465  P...."..227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3234 342c 3139 3829 0d0a                 244,198)..                    
    Date=2017-06-15 Time=08:29:52 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56517 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2665616256 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:29:57 0102021 IP FTP.IP.21 > Outside.IP.56517 : proto TC
    P: P 219144461:219144511(50) win 256 checksum : 36130                           
    0x0000:  4500 005a 1f74 4000 7f06 c3c4 c748 5518  E..Z.t@......HU.              
    0x0010:  629d 9967 0015 dcc5 0d0f e10d 1288 9209  b..g............              
    0x0020:  5018 0100 8d22 0000 3232 3720 456e 7465  P...."..227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3234 342c 3139 3829 0d0a                 244,198)..                    
    Date=2017-06-15 Time=08:29:57 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56517 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2665616256 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:30:07 0102021 IP FTP.IP.21 > Outside.IP.56548 : proto TC
    P: P 759872103:759872153(50) win 256 checksum : 61588                           
    0x0000:  4500 005a 1f7f 4000 7f06 c3b9 c748 5518  E..Z..@......HU.              
    0x0010:  629d 9967 0015 dce4 2d4a ba67 315d 1d13  b..g....-J.g1]..              
    0x0020:  5018 0100 f094 0000 3232 3720 456e 7465  P.......227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3235 302c 3133 3529 0d0a                 250,135)..                    
    Date=2017-06-15 Time=08:30:07 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56548 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=102 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2567035808 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:30:07 0102021 IP FTP.IP.21 > Outside.IP.56548 : proto TC
    P: P 759872103:759872153(50) win 256 checksum : 61588                           
    0x0000:  4500 005a 1f81 4000 7f06 c3b7 c748 5518  E..Z..@......HU.              
    0x0010:  629d 9967 0015 dce4 2d4a ba67 315d 1d13  b..g....-J.g1]..              
    0x0020:  5018 0100 f094 0000 3232 3720 456e 7465  P.......227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3235 302c 3133 3529 0d0a                 250,135)..                    
    Date=2017-06-15 Time=08:30:07 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56548 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=102 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2567035808 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:30:08 0102021 IP FTP.IP.21 > Outside.IP.56548 : proto TC
    P: P 759872103:759872153(50) win 256 checksum : 61588                           
    0x0000:  4500 005a 1f82 4000 7f06 c3b6 c748 5518  E..Z..@......HU.              
    0x0010:  629d 9967 0015 dce4 2d4a ba67 315d 1d13  b..g....-J.g1]..              
    0x0020:  5018 0100 f094 0000 3232 3720 456e 7465  P.......227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3235 302c 3133 3529 0d0a                 250,135)..                    
    Date=2017-06-15 Time=08:30:08 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56548 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=102 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2567035808 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:30:09 0102021 IP FTP.IP.21 > Outside.IP.56548 : proto TC
    P: P 759872103:759872153(50) win 256 checksum : 61588                           
    0x0000:  4500 005a 1f83 4000 7f06 c3b5 c748 5518  E..Z..@......HU.              
    0x0010:  629d 9967 0015 dce4 2d4a ba67 315d 1d13  b..g....-J.g1]..              
    0x0020:  5018 0100 f094 0000 3232 3720 456e 7465  P.......227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3235 302c 3133 3529 0d0a                 250,135)..                    
    Date=2017-06-15 Time=08:30:09 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56548 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=102 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2567035808 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:30:11 0102021 IP FTP.IP.21 > Outside.IP.56548 : proto TC
    P: P 759872103:759872153(50) win 256 checksum : 61588                           
    0x0000:  4500 005a 1f84 4000 7f06 c3b4 c748 5518  E..Z..@......HU.              
    0x0010:  629d 9967 0015 dce4 2d4a ba67 315d 1d13  b..g....-J.g1]..              
    0x0020:  5018 0100 f094 0000 3232 3720 456e 7465  P.......227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3235 302c 3133 3529 0d0a                 250,135)..                    
    Date=2017-06-15 Time=08:30:11 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56548 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=102 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2567035808 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                                                                    
    2017-06-15 08:30:16 0102021 IP FTP.IP.21 > Outside.IP.56548 : proto TC
    P: P 759872103:759872153(50) win 256 checksum : 61588                           
    0x0000:  4500 005a 1f85 4000 7f06 c3b3 c748 5518  E..Z..@......HU.              
    0x0010:  629d 9967 0015 dce4 2d4a ba67 315d 1d13  b..g....-J.g1]..              
    0x0020:  5018 0100 f094 0000 3232 3720 456e 7465  P.......227.Ente              
    0x0030:  7269 6e67 2050 6173 7369 7665 204d 6f64  ring.Passive.Mod              
    0x0040:  6520 2831 3939 2c37 322c 3835 2c32 342c  e.(199,72,85,24,              
    0x0050:  3235 302c 3133 3529 0d0a                 250,135)..                    
    Date=2017-06-15 Time=08:30:16 log_id=0102021 log_type=Firewall log_component=Inv
    alid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A i
    n_dev= out_dev= inzone_id=2 outzone_id=2 source_mac= dest_mac= l3_protocol=IP so
    urce_ip=FTP.IP dest_ip=Outside.IP l4_protocol=TCP source_port=21 dest_
    port=56548 fw_rule_id=9 policytype=3 live_userid=0 userid=0 user_gp=0 ips_id=0 s
    slvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_
    done=0 proxy_flags=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=5 catego
    ry_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0
    inmark=0x8001 nfqueue=102 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_
    fix=0 ctflags=8 connid=2567035808 masterid=0 status=430 state=3 sent_pkts=N/A re
    cv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran
    _dst_ip=N/A tran_dst_port=N/A                                                   
                                    

  • 0 in reply to ViciousMagician1116

    Thanks.

    Can you share the firewall rule?

  • 0 in reply to ViciousMagician1116

    I got it!!!   Turned on rewrite source address for the 20th or so time but this time I choose MASQ instead of one I created for the public ip this rule is hosted on and it works.

Reply Children
No Data