FTP client access everything?
I started FTP File Sharing and it works as expected - BUT the FTP client is allowed to see everything on the entire drive...!
I have set the Home Directory to a folder, but you are still able to go down in the hierarchy and see everything else on the computer. I want the user to ONLY see her home directory (and folders in it of course), nothing else.
How do I solve this?
Thanks,
Andreas
Thank you, but did you try this ?
Can you describe in detail "exclusion rule for FTP traffic" ?!
In my previous post, I want to say that if you use Win 2008/2012 RAS+NAT as a network gateway, than it is not possible to make FTP-connections to external FTP servers from the computers behind that gateway.
And the standard attempts to make "Allow"-rules for port 21 in the gateway firewall (Win 2008/2012), do not solve the problem.
No matter which FTP-client you can try to use.
To see this problem, just make few simple tests:
">telnet <ftp-server> 21"
with firewall on/off and inbound/outbound "Allow port 21 rule (All/Domain/Private/Public)"
In my country, the Government Tax Department uses FTP-protocol to collect monthly data from companies.
And it is too stupid scenario (to be a small company and to) upgrade from Win 2003 to a newer 2008/2012 and than to not be able to make all your jobs.
-------EDIT---------
The same problem (and its solution) is described here:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/0c68aed6-e22b-4cd4-86bd-f3c767e88349/advanced-firewall-blocking-through-ftp-traffic-rras
The magic command:
">netsh routing ip nat delete ftp"
solved the problem for me.
And here is the description of this command - "Disables the FTP proxy on the NAT server."
http://technet.microsoft.com/en-us/library/cc754535(v=ws.10).aspx#BKMK_106
Similar Messages
-
How can FTP users access my NAS system via FTP client?
I recently purchased a 2 bay, 4TB Buffalo Link Station DUO in order to solve some FTP issues. I have about 50 users outside my LAN that need to connect drop files on my NAS, however nobody seems able to connect via FTP client. If they login using the Web Access Dynamic DNS address they can read and write via their web browser, but it's clunky and slow.
My NAS system has been given the IP adress of 192.168.1.254 which seem to me that it's a local IP adress, not a public/static IP. Do I need to manually assign an IP adress to my NAS system in order fot users to log into that specific IP and go directly to the shared folders on the NAS system?
Thanks in advance!Your NAS is getting that IP because it is behind your Router, which is the normal way to use it and as it should be.
You can not ASSIGN a public IP you your NAS. Only your ISP can do that and usually that incures an extra cost for more than 1 Public IP address. Usually included with a Business account and most of the time only available with a Business account. ISP do not want home owners running FTP or Mail servers on a residential acounts.
As noted you have to forward the noraml FTP port, port 21, in your Router to the IP of the NAS. Since you already have that port forwarded to your Mac, which I have no idea why you did that, you have to either change that port forwarding to the NAS IP or make the FTP server on the NAS respond to some other port and forward that on the router to the IP of the NAS. The to access the NAS FTP server you have to enter the piblic IP address of your router followed with a :and port #. XXX.XXX.XXX.XXX:22 or whatever port # you assign to the FTP server on the NAS. -
Can not Access disk drive attached to WRT350N via an FTP client
Background
I have a WRT350N v1 running the most current firmware. I have a static IP address for the WRT350N and I can ping it over the internet. I have a disk drive attached to the 350N with a FAT32 partition that has been set up for shared access for a selected group and user. I have worked with cicso/linksys support to verify the linksys350N is set up correctly (?).
Problem
I can not access the disk drive attached to the WRT350N via an FTP client. I have tried the following FTP Clients: Transmit and Filezilla. I get a "Connection established, waiting for welcome message...' message on the FTP client. Then it says Connect timeout, Can not connect to server. I CAN connect to other FTP sites so its not the FTP client software.
What I have done so far
1. deleted the old and added a new FTP group and user
2. unplugged and reconnected my WRT350N and my cable modem
3. Contacted Cisco/linksys support on-line and they verified my setup and can ping my 350N but thats as far as they are willing to help
I haven' a clue as to what to do next. Any and all help is greatly appreciated.Access your router set-up and make sure you have :
1. Enabled FTP Server and Internet Access under the FTP Server subtab under Storage...
2. Reduced the MTU size to 1300 under SetUp...
3. Unchecked Filter Anonymous Internet Requests...
If you have done all this and nothing works, then, you need to upgrade your router's firmware and re-configure your router and then enter the settings...
Download Firmware 3.23 MB...
Follow these steps to upgrade the firmware on the device : -
Open an Internet Explorer browser page on a computer hard wired to the router...
In the address bar type - 192.168.1.1...Leave the username blank & in password use admin in lower case...
Click on the 'Administration' tab- Then click on the 'Firmware Upgrade' sub tab- Here click on 'Browse' and browse the .bin firmware file and click on "Upgrade"...
Wait for few seconds until it shows that "Upgrade is successful" After the firmware upgrade, click on "Reboot" and you will be returned back to the same page OR it will say "Page cannot be displayed".
Now reset your router :
Press and hold the reset button for 30 seconds...Release the reset button...Unplug the power cable from your router, wait for 30 seconds and re-connect the power cable...Now re-configure your router...
1. Enable FTP Server and Internet Access under the FTP Server subtab under Storage...
2. Reduce the MTU size to 1300 under SetUp...3. Uncheck Filter Anonymous Internet Requests...See if this works for you... -
I have access to upload files...to my business catalyst site through a browser.
My FTP client route is non functional as it has started to reject my password.
this is the second occurance of this type.
Id use the browser access only but as it wont accept html files I need the ftp access as well
What could be happening and how do I solve this issue.?I changed ,my password yesterday. finally gained access via my ftp client this morning.
Thank you -
FTP Clients on E72: can't get any to work
Hello again.
So, I've been trying to get FTP Client functionality on my Nokia E72. I guess I'm just doing something wrong, but I cannot figure it out.
I tried:
* SIC! FTP (native Symbian App)
* PaderSyncFTP (Java)
* MobyExplorer (Java)
None of the applications work on my E72. They do work however (with the same SIM card) on my Nokia 6120 classic.
The applications seemingly try to connect on the E72, however it never actually initiates a packet data connection at all. As if there wouldn't be an application trying to access the Internet.. I also tried to set up WLAN as my primary access point. Works for everything else, but not for those FTP clients.
I tried several FTP servers on different ports (21, 666, 667). All work on 6120 classic, none work on E72. Also tried to switch from passive to active mode to no avail.
Funny thing is: When I use my PuTTY SSH Client on E72 to just probe an FTP servers port, that works! I can see the connection attempt in my FTP Servers logfile, and I can see the Server responding in PuTTY!! But with the actual FTP clients i never even get out into the network, wether I try to use WLAN or 3.5G..
I'm lost. Everything else works. SSH2 using PuTTY works, Skype works, webbrowsing works.
What could be prohibiting all those FTP clients from initiating a connection?! For MobyExplorer I even tried all of its four "connection modes" that they have for "buggy firmwares". Doesn't make a difference at all.
Also: Those apps never ask for an Access Point on the E72, even if the AP is configured to do so.
I have no idea what to do... Any advice would be appreciated! Maybe it's just some strange configuration issue..
Thanks.k-lite is a free codec that makes windows media player 11 work and it has its own player.
T430u, x301, x200T, x61T, x61, x32, x41T, x40, U160, ThinkPad Tablet 1838-22R, Z500 touch, Yoga Tab 2 Windows 8.1, Yoga Tablet 3 Pro
Did someone help you today? Press the star on the left to thank them with a Kudo!
If you find a post helpful and it answers your question, please mark it as an "Accepted Solution"!
If someone helped you today, pay it forward. Help Someone Else!
English Community Deutsche Community Comunidad en Español Русскоязычное Сообщество -
Hello
I am trying to install Exchange Server 2010 beta 1 onto a Windows Server 2008 R2 (build 7000) machine which has also been set up as a domain controller.
However when attempting to install the Client Access role, setup fails with the error below.
Does anyone know of a way to get around this please?
I have already searched for this error and not found any similar threads.
Also every time I press the code button on this forum it crashes the browser and I keep losing the message! (IE8 from within Server R2). Also the message box is very small, will not expand and keeps jumping to the top.
Thanks
Robin
[code]
Summary: 4 item(s). 1 succeeded, 1 failed.
Elapsed time: 00:00:01
Preparing Setup
Completed
Elapsed Time: 00:00:00
Client Access Role
Failed
Error:
The execution of: "$error.Clear(); Install-ExchangeCertificate -services "IIS, POP, IMAP" -DomainController $RoleDomainController", generated the following error: "Could not grant Network Service access to the certificate with thumbprint 2F320F5D5B5C6873E54C8AB57F604D8AFA31D18C because a cryptographic exception was thrown.".
Could not grant Network Service access to the certificate with thumbprint 2F320F5D5B5C6873E54C8AB57F604D8AFA31D18C because a cryptographic exception was thrown.
Access is denied.
Elapsed Time: 00:00:01
Mailbox Role
Cancelled
Finalizing Setup
Cancelled
[/code]
Robin WilsonHello
Thanks for all the replies.
I have since wiped the system and installed everything again and it all worked this time so not sure what was wrong last time. I did try to uninstall all Exchange components and then uninstall IIS and Application server, reboot and re-install but I received the same error still when it came to installing the client access role.
Walter: I just attempted the standard installation which should have used the default self-signed certificate. Everything was a fresh install done at the same time on a freshly formatted PC.
For info last time when it failed to work:
- Installed Windows Server 2008 R2
- Installed Domain Controller role using dcpromo. I set the forest and domain as Windows Server 2008 R2
- Added a forest trust between main domain and test Exchange domain (set up as ex2010.local)
- Installed IIS and Application Server role
- Installed Hyper-v role
- Installed Desktop Experience feature
- Installed Exchange and recieved the error
When it worked I set up the forest and domain in Windows Server 2008 mode (i.e. not R2), installed Exchange first and then set up the forest trust and then Hyper-v. It did say it failed to configure dns which was probably because it started trying to do automatic updates half way through the dcpromo! DNS seems to work ok though.
I did notice this time that Hyper-v gave a warning about the virtual network adapter not being set up correctly and the local network did not work correctly although I could access the internet. Not sure if this could have been related to the cause of the problem previously. For now I have disabled the virtual network until I get time to try and get it working and so the mail will work in the meantime.
I also noticed that Hyper-v added an extra 443 ssl binding to the default website so as it had 2 bindings on port 443 it refused to start. After deleting one it worked.
I decided to install Exchange onto a domain controller as it is only a test and I wouldn't do it in a live environment. I am also short of test machines! It didn't give me any warnings about this actually, I think previous versions warn you that it is not recommended.
Andreas and Chinthaka: I did not know about the requirement to run the domain at 2003 mode. The main domain is running in 2008 mode with Exchange 2007 so I assume this is just a temporary beta related requirement. It does seem to be working (second attempt) so far in a 2008 mode domain although I haven't had a chance to fully test it yet.
Thanks
Robin
P.S. Sorry it's taken me a while to reply!
Robin Wilson -
EMC Crash when i try to - reset client access virtual directory
Hi All,
I have one exchagne server 2010 sp3 rollup 7 installed on server 2012R2 Std.
When i try to reset client access virtual directory the MMC is crashing.
In the event viewer i can find 3 error after to crash:
1.
The program mmc.exe version 6.3.9600.17415 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 2360
Start Time: 01d04e7b531a4a0d
Termination Time: 4294967295
Application Path: C:\Windows\system32\mmc.exe
Report Id: 69db84d3-ba91-11e4-80c3-0050569b5787
Faulting package full name:
Faulting package-relative application ID:
2.
Application: mmc.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Reflection.TargetInvocationException
Stack:
at Microsoft.ManagementConsole.Executive.MmcThreadMessageWindow.OnThreadException(Exception e)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG& msg)
at System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr dwComponentID, Int32 reason, Int32 pvLoopData)
at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(Int32 reason, ApplicationContext context)
at System.Windows.Forms.Application.ThreadContext.RunMessageLoop(Int32 reason, ApplicationContext context)
at Microsoft.ManagementConsole.Internal.SnapInMessagePumpProxy.Microsoft.ManagementConsole.Internal.ISnapInMessagePumpProxy.Run()
at Microsoft.ManagementConsole.Executive.SnapInThread.OnThreadStart()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Threading.ThreadHelper.ThreadStart()
3.
Faulting application name: mmc.exe, version: 6.3.9600.17415, time stamp: 0x54504e26
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54505737
Exception code: 0xe0434352
Fault offset: 0x0000000000008b9c
Faulting process id: 0x2014
Faulting application start time: 0x01d04e9e432feaef
Faulting application path: C:\Windows\system32\mmc.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: b8276755-ba91-11e4-80c3-0050569b5787
Faulting package full name:
Faulting package-relative application ID:
When i try to preform the task from EMC that installed on my PC (Win 7 SP1 x64) everything works fine
Thank you.Hi Eliran,
Thank you for your question.
Are there any update recently?
We could refer to the following steps to troubleshoot:
1)disable A/V
2) Run: DISM.exe /Online /Cleanup-image /Restorehealth
http://support.microsoft.com/kb/947821/en-gb
3) follow http://support.microsoft.com/kb/929833/en-gb to upload %WinDir%\Logs\CBS\CBS.log
4) disable snap-ins exept DNS-snapin
5) run SDP
6) enable A/V
We could also re-install .Net 4.0 to check if the issue persist by the following link:
http://www.microsoft.com/en-us/download/details.aspx?id=17718
If the issue persist, we could install Exchange 2010 SP3 CU8 by the following link:
http://www.microsoft.com/en-us/download/details.aspx?id=45225
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim -
FTP client is not working in active mode
Hi,
I have a ftp issue trying to download iweb files.
My provider enabled me a ftp access.
I tried to connect to it with transmit or rbrowser ftp client (passive mode disabled). The connection works well but i can not retrieve the list of files.
However using my PC and filezilla ftp client in active mode, the connection did work properly.
Any idea to help make this connection work on my mac ?
ThanksPerhaps this will help...
http://slacksite.com/other/ftp.html
"The main problem with active mode FTP actually falls on the client side. The FTP client doesn't make the actual connection to the data port of the server--it simply tells the server what port it is listening on and the server connects back to the specified port on the client. From the client side firewall this appears to be an outside system initiating a connection to an internal client--something that is usually blocked." -
Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
IngoHi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo -
No client access on DAG switchover - Single site
Let’s summarize my environment:
I have 3 Exchange 2013 SP1 (cu4) server in one site. CAS01, only have cas role and MBX01&MBX02 have only mailbox. Both mailbox are in a DAG (DAG01).
The server mounting my database is MBX02. Whenever a switchover to MBX01 occur (or when I force it whith Move-ActiveMailboxDatabase –server MBX02 -ActivateOnServer MBX01), all my client get disconnected so no more outlook, active sync
and even owa. As soon as I roll them back on MBX02, everything returns to normal. However, every single email delivered while the DAG was mounted on MBX01 are getting delivered to the mailbox server so dag is working properly for the mail flow, minus the client
access HA.
Now I know that on Exchange 2010 and the issue could have been with the value of –rpcclientaccessserver on my database, but this value is not used anymore on 2013.
Any ideas?
ThanksHi S.Nithyanandham
1. No my servers are working pretty fine is I create a non dag DB on MBX01, Client access and mail flow is fine. Turning off both Windows firewall didn’t
change anything
2.
Server Check Result Error
MBX01 ClusterService Passed
MBX01 ReplayService Passed
MBX01 ActiveManager Passed
MBX01 TasksRpcListener Passed
MBX01 TcpListener Passed
MBX01 ServerLocatorService Passed
MBX01 DagMembersUp Passed
MBX01 ClusterNetwork Passed
MBX01 QuorumGroup Passed
MBX01 FileShareQuorum Passed
MBX01 DatabaseRedundancy Passed
MBX01 DatabaseAvailability Passed
Server Check Result Error
MBX02 ClusterService Passed
MBX02 ReplayService Passed
MBX02 ActiveManager Passed
MBX02 TasksRpcListener Passed
MBX02 TcpListener Passed
MBX02 ServerLocatorService Passed
MBX02 DagMembersUp Passed
MBX02 ClusterNetwork Passed
MBX02 QuorumGroup Passed
MBX02 FileShareQuorum Passed
MBX02 DatabaseRedundancy Passed
MBX02 DatabaseAvailability Passed
MBX02 DBCopySuspended Passed
MBX02 DBCopyFailed Passed
MBX02 DBInitializing Passed
MBX02 DBDisconnected Passed
MBX02 DBLogCopyKeepingUp Passed
MBX02 DBLogReplayKeepingUp Passed
3. I’ve double check that and recreated the dag binding multiple time with no luck.
4. yes they are
[PS] C:\Windows\system32>get-mailboxdatabasecopystatus | ft -au
Name Status CopyQueueLength ReplayQueueLength LastInspectedLogTime ContentIndexState
DB1\MBX01 Mounted 0 0
Healthy
DB2\MBX01 Mounted 0 0
Healthy
DB3\MBX01 Mounted 0 0
Healthy
DB4\MBX01 Mounted 0 0
Healthy
[PS] C:\Windows\system32>get-mailboxdatabasecopystatus -server mbx02 | ft -au
Name Status CopyQueueLength ReplayQueueLength LastInspectedLogTime ContentIndexState
DB1\MBX02 Healthy 0 0 2015-01-12 19:57:58 Healthy
DB2\MBX02 Healthy 0 0 2015-01-12 19:58:10 Healthy
DB3\MBX02 Healthy 0 0 2015-01-12 19:58:07 Healthy
DB4\MBX02 Healthy 0 0 2015-01-12 20:00:23 Healthy
5. None except those related to the failover if I bring MBX02 down
6. File share is fine and acessible.
Then please explain me what you are trying to say on the below mentioned line?
When I have a failover and database are mounted and healthy I can’t connect trougth any devices but email sent to my organization are devilered in databases correctly. I can see them with Get-MessageTrackingLog. In addition, my Wtachguard
in front of my cas is not reporting any bounce or error, everything is delivred and queue is empty inside it.
A big Thank you for your help
Alex
Alexandre Contant -
How to get the FTP clients to work?
This is something that (to me at least) should be trivial but I just can't
get it to work at all.
How do you get an FTP client to work?
I've tried several GUI clients as well as the terminal FTP command and they
all seem to get stuck entering passive mode - according to the log entries
they send the command.... And then nothing or a timeout, the following is
from the terminal FTP command:
Titania:~ susan$ ftp ftp.apple.com
Trying 17.254.16.11...
Connected to ftp.apple.com.
220 17.254.16.11 FTP server ready
Name (ftp.apple.com:susan): anonymous
331 Anonymous login ok, send your complete email address as your password.
Password:
230 Anonymous access granted, restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
501 EPSV: Operation not permitted
227 Entering Passive Mode (17,254,16,11,223,157).
200 PORT command successful
421 Service not available, remote server timed out. Connection closed
ftp>
In my System Preferences -> Network panel in the Proxies tab, I have the
"use Passive FTP mode (PASV) checked.
I also have checked the FTP firewall option (but I think that is only if I'm
acting as an FTP server).
I am connected to the internet via a Netgear wireless router.
I also have an old Windows laptop that also uses the same wireless router
and it can FTP quite happily!!!!!
Any suggestions would be gratefully received.
Susanejn - thanks for your continued assistance.
I've tried turning the firewall off but this does not appear to make any difference(*). Also, I have Parallels installed and I'm sharing the internet connection with this (even though Parallels itself is not currently running). Turning this sharing off doesn't seem to change anything either.
I have noticed some entries in the ifpw.log file that coincide with some of the ftp actions. Given the following terminal session:
Titania:~ susan$ ftp ftp.apple.com
Trying 17.254.16.10...
Connected to ftp.apple.com.
220 17.254.16.10 FTP server ready
Name (ftp.apple.com:susan): anonymous
331 Anonymous login ok, send your complete email address as your password.
Password:
230 Anonymous access granted, restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
501 EPSV: Operation not permitted
227 Entering Passive Mode (17,254,16,10,245,46).
200 PORT command successful
421 Service not available, remote server timed out. Connection closed
ftp>
at the time the "200 PORT command successful" is displayed, the ifpw log starts showing:
Sep 5 09:11:21 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
Sep 5 09:11:24 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
Sep 5 09:11:27 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
Sep 5 09:11:30 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
Sep 5 09:11:33 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
Sep 5 09:11:36 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
Sep 5 09:11:42 Titania ipfw: 12190 Deny TCP 17.254.16.10:20 192.168.0.5:49162 in via en1
which makes sense as the system tries to go for an active transfer.
(*) Actually, while I've been writing this, I've been playing on the terminal as well. I've found the combination of:
1) turning off the firewall
2) starting ftp
3) issuing the 'passive' command to turn off passive mode
4) issuing 'ls' etc. works
Looks like I've not been waiting long enough for the ftp client to get sick of trying the passive transfer and switching to an active one with the firewakk turned off!
Still doesn't answer the question - why does passive mode not work?
Susan -
Hello all,
I am maintaining a part of our product that requires monitoring mailboxes for events. This is currently being done by using streaming connections for getting the notifications. Our solution has been successful for situations with smaller numbers
of mailboxes, ~200 or less. However we are seeing some issues when scaling up to say, 5000 mailboxes.
The error and the sequence leading up to it are as follows:
Make an Exchange Service Account.
exchSvc.ConnectionGroupName = someGroupName;
add to the httpheaders ("X-AnchorMailbox", userSmtp) and ("X-PreferServerAffinity", "true");
create a new impersonated UserId for the userSmtp address that is our anchor mailbox.
set the Exchange Service account ImpersonatedUserID to the one we just made.
ExchangeServiceAccount.SubscribeToStreamingNotifications(new FolderId[] { WellKnownFolderName.Inbox }, _mailEvents);
to this point everything was successful, saw no error messages.
we create a second impersonated UserID for a different mailbox, and repeat the process above from that step forward. Upon the final step, subscribing to the streaming notifications we get the error:
Exception: Microsoft.Exchange.WebServices.Data.ServiceResponseException: One or more subscriptions in the request reside on another Client Access server. GetStreamingEvents won't proxy in the event of a batch request.
This is only the second subscription that we are trying to add to this connection, and it is to a different mailbox than the first.
Can anyone please help point me to where this is going wrong?>> Is there a good way to verify the number of subscriptions in a group?
Not that I know of you should be tracking this in your code there are no server side operations in EWS to even tell you if there are active subscriptions on a mailbox.
>>The error I am getting is on the second subscription in a new group, just after doing the anchor mailbox so I don't think we are hitting the 200 limit.
It's hard to say without seeing your code but it sounds like there is problem with your grouping code. One way to validate this is that with every request you make with the EWS managed API there is a
RequestId header http://blogs.msdn.com/b/exchangedev/archive/2012/06/18/exchange-web-services-managed-api-1-2-1-now-released.aspx
you should be able to give that RequestId to the Office365 support people and they should be able to check the EWS Log on the server and tell you more about what's happening (it maybe server side bug). Something doesn't quite add up in that the X-BackEndOverrideCookie
is what ultimately determines what server the request ends up at and the error is essentially telling you its ending up at the wrong server (have you looked at the headers on the error message?). Is it always one group of users that fails have
you tried different groups and different combinations etc.
Cheers
Glen -
I cannot get access to my web server on my new Mac. I have finally gotten back to working on a Mac, after having to use Windows for work for a long time, but I cannot get ANY ftp client to access a server that I have been accessing for two years. I am truly baffled. I have been using CuteFTP to make passive mode connections, but on my Mac, no luck. I get connection, authentication, PASV mode start, then the whole thing seems to time out while LIST is happening. This occurs with the firewall on or off.
I am working on a Mac Book Pro, on an Ethernet network that has DSL and a Linksys router. I truly seek enlightenment.
Mac Book Pro Mac OS X (10.4.8) 2.13 gHz, 2 gig RAMAlso, I just tested using -A, and no go.
Hmmmm. Okay. Try logging in with the comand line client, and add the "-d" to the two different ftp commands:
<pre class="command">ftp -A -d ftp.servername.com</pre>for active mode or
<pre class="command">ftp -d ftp.servername.com</pre>Adding the "-d" makes it a little more verbose than normal. Perhaps there'll be a clue in there.
If that doesn't give you any clues, one more thing to try is to toggle the use of PORT/LPRT commands. Once you're connected to the remote server, and before you list the directory, issue this command at the ftp prompt:
<pre class="command">sendport</pre>If I do this on the ftp server I'm connecting to, I get this result (I started ftp with -d):
<pre class="command">ftp> sendport
Use of PORT/LPRT cmds off.
ftp> ls
---> LIST
421 Service not available, remote server timed out. Connection closed</pre>which is not exactly the same as your error, but kind of close.
Finally, since it's a laptop, have you tried connecting to the server from another network, like at work or a friend's house? Also, can you log into another ftp server? Perhaps there's a problem on the server end at your web server. It seems unlikely, but it's possible. You could try ftp.apple.com. You can log in with the username "anonymous" and giving an email address as the password. There's not much there any more, but it might be a good way to test.
Finally, are there any messages in the console or system log when you try to log in? You can see them using the Console application from your Utilities folder. Also, if you click on the "Logs" icon in the Console app, you'll toggle a listing of logs and directories. Look under the /var/log listing for the ipfw.log and see if anything gets logged in there when you're trying to connect to your server.
charlie -
Hi all, does anyone know if there is a command-line (or gui) ftps client available on the SunRays that can be used to ftp to beehive? I can't find one installed. If there isn't one installed by default, any idea who I should talk to?
thanks,
-jeffHi Phil, I am looking for a somewhat automated way of updating a twiki / workspace page with a blurb of text as well as some file attachments. Essentially I am looking for an easy way to archive specified emails (and their attachments) such that they can be accessed by a set of people (essentially whoever has webspace access).
The FTPS idea came from an old post of yours I think (Not authorised on file upload I was hoping to automate this on Solaris (SPARC or I guess x86) or potentially from my Mac at home. I guess on the Mac I could try webDav access? But I was a little concerned by that post from last year as these mails sometimes have large attachments. Don't have much beehive workspace / teamcollab experience, so apologies for any n00b questions :)
thx,
-jeff -
Hello there!
Find strange problem working with WRT54G2 (firmware 1.0.04 - latest)
I try to connect to ftp server and very often get disconnects - see example of log below:
2009-09-20 23:37:50 3292 0 Status DNS request *******
2009-09-20 23:37:50 3292 0 Status Connection with *********
2009-09-20 23:37:50 3292 0 Status Connection established
2009-09-20 23:37:51 3292 0 Reply: 220 Welcome to Hosting Telesystems ftp service.
2009-09-20 23:37:51 3292 0 Command: USER ********
2009-09-20 23:37:51 3292 0 Reply: 331 Please specify the password.
2009-09-20 23:37:51 3292 0 Command: PASS ********
2009-09-20 23:37:51 3292 0 Reply: 230 Login successful.
2009-09-20 23:37:51 3292 0 Command: SYST
2009-09-20 23:37:51 3292 0 Reply: 215 UNIX Type: L8
2009-09-20 23:37:51 3292 0 Command: FEAT
2009-09-20 23:37:51 3292 0 Reply: 211-Features:
2009-09-20 23:37:51 3292 0 Reply: EPRT
2009-09-20 23:37:51 3292 0 Reply: EPSV
2009-09-20 23:37:51 3292 0 Reply: MDTM
2009-09-20 23:37:51 3292 0 Reply: PASV
2009-09-20 23:37:51 3292 0 Reply: REST STREAM
2009-09-20 23:37:51 3292 0 Reply: SIZE
2009-09-20 23:37:51 3292 0 Reply: TVFS
2009-09-20 23:37:51 3292 0 Reply: UTF8
2009-09-20 23:37:51 3292 0 Reply: 211 End
2009-09-20 23:37:51 3292 0 Command: OPTS UTF8 ON
2009-09-20 23:37:51 3292 0 Reply: 200 Always in UTF8 mode.
2009-09-20 23:37:51 3292 0 Status Connection established
2009-09-20 23:37:51 3292 0 Status getting list of directories
2009-09-20 23:37:51 3292 0 Command: PWD
2009-09-20 23:37:51 3292 0 Reply: 257 "/"
2009-09-20 23:37:51 3292 0 Command: TYPE I
2009-09-20 23:37:51 3292 0 Reply: 200 Switching to Binary mode.
2009-09-20 23:37:51 3292 0 Command: PASV
2009-09-20 23:37:54 3292 0 Ошибка: ECONNABORTED - Connection aborted
Same for all ftp servers i'm trying to access (even with ftp-server of my provider just next hop from router). Also i tried different ftp clients. Tracert doesn't indicate any troubles on the way.
But most interesting that after several tries it's connecting successfully. And after 10-20 tries i could even upload/download file to server. So it does not completely blocked somewhere, it works but very not stable.
I tried same client with Linksys WAG54GS (DSL modem) just to check could it be problem with my laptop and it works very good, no problems at all.
Looks like my WRT54G2 doesn't work very well with ftp. May be NAT problem or something else? Any ideas how this could be fixed?
Many thanks in advance,
mitkoWell, try to reflash the firmware for the router and forward the port 21 on the router for ip address of computer on which you are trying to access the FTP.
Maybe you are looking for
-
Trying to install update-not working
I am trying to install the new iTunes update and getting nowhere. I click on dowload update and nothing happens. I have tried quitting iTunes and restarting my compuer to no avail. iTunes is acting a mess, keeps freezing my syncs and stops song pr
-
PDF does not contain all document elements
I've created a new brochure using InDesign CS5 and everything looks OK in the InDesign format, but when I export the file into pdf-format, not all elements are included. The pdf does not display the top banner on one page and a transparent figure is
-
Hello, We need the ability to display message attachments in the browser. Some files display in IE fine (PDF, TXT, DOC, GIF, JPG) but others don't (PPT, XLS, RTF) -- instead a download dialog box is displayed. Anyone know how to get PowerPoint, Excel
-
PO return Order with replacing of goods
Hi For not compliant goods, usually we create a PO Return Order by flagging the check-box "Return" and the check-box "Free of charge" if we ask to vendor to replace the goods. Later we send the goods to the Vendor with MIGO and 161 movement-type. Som
-
Updating safari to 2.0.1 after updating to 10.4.5
here's my situation: i updated to 10.4.5 and safari sort of disappeared, so i had to reinstall safari from the os x disc. the problem: now i cannot update safari 2.0 to 2.0.1 - the safari update, being an update that precedes 10.4.5, states that i ha