ACE FTP problem in active mode

Hi everyone,
i have a problem with active ftp (passive ftp works fine).
here is my conf :
access-list ANY line 8 extended permit icmp any any
access-list ANY line 16 extended permit ip any any
rserver host ftp1
  ip address 10.0.151.131
  inservice
rserver host ftp2
  ip address 10.0.151.132
  inservice
serverfarm host ftp
  transparent
  failaction reassign
  rserver ftp1
    inservice
  rserver ftp2
    inservice
class-map match-any vip
  2 match virtual-address X.X.X.X tcp eq ftp
policy-map multi-match LBPOL
  class vip
    loadbalance vip inservice
    loadbalance policy lbpol
    loadbalance vip icmp-reply active
    inspect ftp
interface vlan 1000
  description public-side
  ip address Y.Y.Y.Y M.M.M.M
  no normalization
  no icmp-guard
  access-group input ANY
  service-policy input REMOTE_MGMT_ALLOW_POLICY
  service-policy input LBPOL
  no shutdown
interface vlan 100
  description private-side
  ip address 10.0.99.160 255.255.0.0
  service-policy input REMOTE_MGMT_ALLOW_POLICY
  no shutdown
on both hosts, i added X.X.X.X vip and the good rule/route with iproute2.
as i said at the beginning, passive ftp is ok. active is not.
while in active mode, i can connect to the ftp but any list/put/get fails.
any idea ?
MA

One thing I don't understand here is why do you have
serverfarm host ftp
  transparent
With this in place the ACE will not rewrite the destination IP and the server will receive a packet destined to the VIP. This is not very common, but it can work. The rest of your config seems to be fine, except the missing lbpol policy.
Which sw version are you running?

Similar Messages

  • How to  Connect to ftp server in active mode using the finder

    How can I can I use the finder command "connect to server" to connect to a ftp server using the active Mode. With Cyberduck I can connect to this server only in active mode. Apparently the connect to server command uses the ftp passive mode.
    Or is it an other way to mount on the desktop a ftp server in active mode?
    Thank you

    Passive mode can be disabled in your network settings, but I have a feeling what you're actually asking for is the ability to upload, and the answer to that is the Finder can't do it. There are some filesystem plugins out there that provide this functionality, but they cost money.

  • Some FTP servers require active mode for connection.

    Is there any option for select active mode during FTP server connection in iweb ?

    No, but go and Click on the Apple symbol on your Mac and then open System Preferences.  Once is System Preferences go and open Network and then in the bottom right corner of Network click on Advanced and then click on Proxies and at the bottom of the Proxies page there is a setting called passive ftp mode that might be check by default.  If it is, then try unchecking it and then uploading your site with iWeb ftp and seeing what happens.
    If this does not work, then your other option of course is to publish your site to a local folder from iWeb and then use something like Cyberduck to upload your site.

  • FTP client is not working in active mode

    Hi,
    I have a ftp issue trying to download iweb files.
    My provider enabled me a ftp access.
    I tried to connect to it with transmit or rbrowser ftp client (passive mode disabled). The connection works well but i can not retrieve the list of files.
    However using my PC and filezilla ftp client in active mode, the connection did work properly.
    Any idea to help make this connection work on my mac ?
    Thanks

    Perhaps this will help...
    http://slacksite.com/other/ftp.html
    "The main problem with active mode FTP actually falls on the client side. The FTP client doesn't make the actual connection to the data port of the server--it simply tells the server what port it is listening on and the server connects back to the specified port on the client. From the client side firewall this appears to be an outside system initiating a connection to an internal client--something that is usually blocked."

  • Active mode FTP access

    Hi,
    I have some problems accessing my hosted FTP server. It is hosted on Windows NT so Active Mode FTP is needed. However, when I access I can login but it will not conduct a directory listing. I tried the Terminal as well as Transmit applications. From a windows machine on same LAN it works. My FTP host claims it is a local issue which seems to be true.
    Searching the forums it seems as "disabling firewall" would make it work. I did that, but it does not work still.
    The error display in terminal is as follows:
    My-iMac:~ troels$ ftp -A XXXXXXXXXX.dk
    Connected to XXXXXXXXXX.dk.
    220 Microsoft FTP Service
    Name (XXXXXXXXXX:troels): xxxxx
    331 Password required for xxxxx.
    Password:
    230 User xxxxx logged in.
    Remote system type is Windows_NT.
    ftp> ls
    200 PORT command successful.
    150 Opening ASCII mode data connection for /bin/ls.
    ftp: Poll timeout waiting before accept
    425 Can't open data connection.
    500 '?ABOR': command not understood
    ftp>
    Thanks in advance.
    Best
    Troels

    I think given that my router's NAT and SPI act as a robust firewall, I may as well just turn the OS X firewall off and 'solve' this problem.
    Thanks for your help,
    J
    G5 Dual 2.0 (rev.B); 1.5 GB RAM; 160/250 GB HD   Mac OS X (10.4.7)   Ati Radeon 9600 XT; Smart-UPS 1500 VA; Dell 2007WFP LCD - MacBook 1.83 GHz

  • BPEL FTP Adapter Active Mode

    Does BPEL FTP Adapter supports active ftp mode (instead of passive). Apparently the ftp site for one of the Interfaces uses FTP Adapter and that ftp server it is using supports ONLY active ftp sessions, NOT passive.
    Want are configuration to made to changed to support active mode
    oc4j-ra.xml for ACTIVE ftp and not passive

    Thanks Everybody for the prompt response .
    1) What error does one get when trying to connect to FTP Sever which only support active mode
    No Error , but no file transfer happens. SR and Bug Request for the same is already in place .
    QUESTION
    ========
    Does BPEL FTP Adapter supports active ftp mode (instead of passive).
    ANSWER
    ======
    No, FTP Adapter only supports passive mode. For that purpose there is an Enhancement Request
    already, the Bug 6866124 - NEED SUPPORT FOR PASSIVE FTP ADAPTER AND CUSTOM FTP
    COMMANDS :
    1. The FTP Server needs to be active for the Adapter to work. So, both FTP Server and the FTP adapter must be active for it to work.
    Also you only support PASSIVE mode in our FTP JCA adapter. ACTIVE mode is currently
    considered bad practice and a security vulnerability.
    But, we would require both ACTIVE and PASSIVE modes.
    2. Custom commands are not supported. But, we need the samples for custom FTP Commands and support for it.
    for example: quote site fixrecfm 90...

  • Problem with passive mode FTP server and NAT

    Hi,
    I have a problem with Passive mode FTP and NAT.
    I am trying to run both an FTP server and sharing the Internet connection via NAT. I have by the way specified the passive ports to use in ftpaccess (65000-65534). Everything works fine until someone tries to connect via Passive mode. I have tracked the problem down to the firewall and the rule that handles NAT.
    Firewall rule config without NAT:
    00001 allow udp from any 626 to any dst-port 626
    01000 allow ip from any to any via lo0
    12300 allow ip from any to any
    65535 allow ip from any to any
    Firewall rule config with NAT
    00001 allow udp from any 626 to any dst-port 626
    00010 divert 8668 ip from any to any via en1
    01000 allow ip from any to any via lo0
    12300 allow ip from any to any
    65535 allow ip from any to any
    So, passive ports do not work when NAT is on. If I turn it off, Passive ftp works like a charm.
    But how do I solve my problem? I have in my quest for the answer stumbled upon "-punch_fw" but do not know how to use it or if it even helps me at all?
    Best regards,
    Peter
    B&W G3 Mac OS X (10.4.5)

    Media/Lacrosse-1-tiny.3gp
    I can't find the file on your server.
    They may also need to edit the .htaccess file to allow the .3gp file extension be used. Call them.

  • Any way to set "active mode" for FTP, or to use sFTP instead?

    I have a web host that does not support passive FTP mode.   I need to either set the mode to be "active mode", or I need to use secure FTP (sFTP).  Is there any support for either of these within Muse?

    Hi
    By default , Adobe Muse FTP option uses " Passive Mode" , I am afraid its not possible to switch to "Active Mode" or to switch to Secure FTP. Alternatively, you may export the site locally using " Export as HTML " and then you may use third party FTP client to upload the site to your third party hosting using Active or Secure FTP.
    Let me know if you have any further query.

  • HT5624 when I turn my iMassage on it will go to activation mode  for along time and then fails Whats teh problem ?!!

    when I turn my iMassage on, it will go to activation mode for a long time and then fails. Whats the problem ?!!

    Do you have a texting plan and are you connected to data when you try to activate? Check this support document for trouble with activating iMessage. http://support.apple.com/kb/TS4268

  • HT201442 i have updated my iphone 4s to the new ios 7.1 ,but it stuck on active mode and it needs my account because i used "find my iphone" before ,but the problem is my account is banned by apple i dont know why ,so what should i do ?

    i have updated my iphone 4s to the new ios 7.1 ,but it stuck on active mode and it needs my account because i used "find my iphone" before ,but the problem is my account is banned by apple i dont know why ,so what should i do ?

    You need to update iTunes to 11.1 on your PC

  • ACE FTP issues with "inspect ftp"

    Hello.
    My clients want to access an FTP server, via ACE, and I am having some issues. They can login and issue only one command... the second command will not be accepted an after a few seconds the prompt shows the message "connection closed by remote host".
    I have sniffed traffic and I see that the connection between the client and the ACE has a strange behaviour because ACE open connection to data using an source port of 1039 (it should be 20, since we are usind an active mode client); between the ACE and the real server runs in active mode (I see normal ftp-data packets).
    Other strange thing is that I have FWSM and they let traffic pass from ACE to client (they should expect traffic comming from port 20 and not 1039)
    I am doing source NAT and ACE is doing all the necessary changes on source IP adresses.
    Anyone has seen similar behaviour?
    Any help would be appreciated.
    In attach I send my config and traffic sniffing.
    Thanks in advance.
    Joao Ribau
    P.S. - client is 10.1.44.98; VIP is 10.1.9.150; real server 10.1.36.124

    Hello.
    I didn´t mentioned this before but the gateway of all my networks is an ACE that is loadbalancing traffic to two firewall clusters. I think this is not important because I have a "catch all" VIP in all my interfaces; I assume that ACE forwards traffic with no restrictions or inspections leaving the inspection job to the firewalls and to the ACE that I use to load balance services.
    Don´t think this could be the problem but just to make sure I decided to post it.
    Best regards,
    Joao Ribau.
    P.S. - my configs on the ACE that loadbalance traffic to the firewalls are very straightforward. Serverfarms (interfaces of the firewalls), a class-map with a "catch-all" VIP, policy-map to for the serverfarm, a policy-map to tie the class to the serverfarm and finally a service-policy apllied to each interface.

  • FTP problem: connection going idle or missing; takes a minute to refresh

    Hi, i hope i explain myself, please forgive me my lack of tech-language and if i'm redundant:
    In my office we got a G5 dual that we turn into a server (Mac OS Server 10.5.7) for a couple of websites (for external use). I need this guys to have FTP access for some file sharing. Server is up, websites and databases are running fine, remote administration in local and external network is flawless, everything seems fine, except for the FTP: When i connect with cyberduck or any other FTP app, the authentication is done quickly but then, the connection goes idle (like it didn't exists) so the folder listing takes about a minute. Then, as soon as you get the listing, if you try to put something (i.e, a big file of 50mb, using the local network), the app makes a quick login but then it goes idle again (same, about a minute) and when the connections appears, the transfer goes really fast, after the transfers ends connection goes idle again a minute before managing the folder listing. I know that the connection "goes idle" or "disappears" because i started using little snitch to take a look at it. It appears like if the ftp app wasn´t even trying to connect, then suddenly, it´s there and connects/transfers. Every operation takes this minute to get going. If i try it with a browser, well, it times out. This is happening in both, local and external connection. But every other service is working cool.
    Can you give me any ideas about this matter?
    Message was edited by: rdlfo

    Ok, rather than going for the most problematic protocols known to modern networking, try with something simple.
    Don't test with ftp, test with sftp.
    I would initially suspect you're running into issues with firewalls here; beyond transmitting your credentials in cleartext, the design of ftp is inherently extremely allergic to firewalls, and particularly to transfers over connections that involve both local and remote firewalls.
    ftp is funky here in that it needs two connections between the client and the server, and the second connection tends to get blocked. An ftp active-mode connection has a back-connect from the ftp server to an ephemeral port on the client; traversing firewalls from server to client. An ftp passive-mode connection has a forward connection; a second parallel connection from the client to a specified (usually) ephemeral port on the ftp server; traversing the firewalls.
    Ignoring explicit transfer-mode selection, various clients can (transparently) try to switch between active and passive, too.
    My preferred approach is to avoid ftp. At all. Use sftp. sftp is far easier to punch through firewalls. And sftp doesn't transmit your username and password in cleartext, for that matter.
    The other part of this effort is around ensuring proper file protections and ownership in the web server directories. The web-facing file ownership should be user:www (often root:www) and the www user (the web server) should be able to read its web files, but (in general) should not be able to write to the web files or directories. This is defensive.

  • Problem while activating message mapping

    Hi all,
       I am facing a problem while activating message mapping in IR.It says Object being edited by XXXX and cannot be activated.It's giving my user name itself and even it doesn't allow to go to edit mode even.But I am not opening  it twice.How to monitor all the XI users logged into the XI system and find the users using IR and ID objects.Please help in this regard.
    Thanks.

    Hi Jaya
    It is .....
    http://<host:port>/rep/support/public/LockAdminService
    Hope this helps !!!
    Regards,
    J Augastine

  • Problem with Append mode in File Receiver

    Hello,
    I am facing some problem with Append Mode in File Receiver.
    In channel config, i have given :
    Construction Mode : Append
    File Type : Text
    Message Protocol : File Content Conversion
    The size of the file which i am trying to send is about 9.5MB.
    I got this error,
    "Recovering from loss of connection to database; message
    loaded into queue by recover job: System Job (Failover Recovery)".
    So, it would seem that there was a loss of connnection to the database    
    while the file was being written.
    Note -  XI successfully recovered from the connection loss and   
    successfully wrote the file, however since the communication channel  
    was set to append, it appended to the partial file that was written   
    before the database connection loss. This is not correct. The file    
    should have been overwritten after the recovery even though the communication
    channel was configured to append.                                     
    Can anyone help me on this regard.
    Thanks,
    Soorya.

    Hi Venkat,
    I would suggest u to split the file in to chunks if u face any problem in processing at a time in append mode and also
    Memory Requirements are must 4 processing huge files:
    Q: Which memory requirements does the File Adapter have? Is there a restriction on the maximum file size it can process?
    A: The maximum file size that can be processed by the File Adapter depends on a number of factors:
    o The most important one is the size of the Java heap, which is shared among all messages processed at a certain point in time. In order to be able to process larger messages without an out of memory error (OOM), it is recommended to increase the size of the available Java heap and/or to reduce the concurrency in the system so that fewer messages are processed in parallel.
    o Another factor negatively influencing the maximum message size in releases up to and including XI 3.0 SP 13 is an enabled charcter set (encoding) conversion if the message type is set to "Text".
    o Using the transport protocol "File Transfer Protocol (FTP)" also uses more memory for processing than the transport protocol "File System (NFS)" (up to and including XI 3.0 SP 13).
    o If the Message Protocol "File Content Conversion" is used in a File Sender channel, consider that not only the size of the input file affects the File Adapter's memory usage, but even more the size of the XML resulting from the conversion, which is usually a few factors larger than the original plain text file.
    To reduce the memory consumption in this scenario, consider configuring the setting "Maximum Recordsets per Message" for the sender channel. This will cause the input file to be split into multiple smaller mesages.
    Plz do refer the following links:
    U may plan the availability of ur communication channel using "Planning Availability Times" feature
    http://help.sap.com/saphelp_nw04/helpdata/en/45/06bd029da31122e10000000a11466f/frameset.htm
    /people/sravya.talanki2/blog/2005/11/29/night-mare-processing-huge-files-in-sap-xi
    hi check the below links for reference
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/10748ef7-b2f0-2910-7cb8-c81e7f284af5
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/7086f109-aaa7-2a10-0cb5-f69bd2affd2b
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/2498bf90-0201-0010-4884-83568752a857
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/cc1ec146-0a01-0010-90a9-b1df1d2f346f
    Regards,
    Vinod.

  • NAS200 Ftp problem

    Hi,  
    I have a little problem with my NAS200. When I try to connect to ftp, I got an error like this:
    200 transfer type changed to ascii
    227 entering passive mode
    Whats wrong ?

    Hi gieras. Has this worked before? Have you tried to access it using another computer? Possble reason why you can't access it is Windows firewall settings on your computer. I am not really familiar with the error codes that you mentioned but I've read another post here that may help: https://community.linksys.com/t5/Network-Storage/NAS200-FTP-Problem/td-p/120996

Maybe you are looking for