Access and download FTP on VPN problem

Ok

Here's my situation, we connect to Cisco ASA 5505 on IPSEC VPN cisco forwards the request to our router Juniper.  What we do on the VPN works exept FTP #1

Here I am the Cisco config (with personal information removed).

problem in society is the IP addressing as been IMO butched

We have 6 guests

1.0

2.0

3.0

4.0

5.0

6.0

Since most routers use 0,0 1,0 or 2,0 most of our clients cannot connect to the VPN, then my boss set up our Juniper to translate the IP address

So make us 202,0 access 2.0

Example if to access a server in 192.168.2.220 in RDP that write us in windows RDP 192.168.202.220 and converts of Juniper data 2,220 and everything works fine

EXCEPT FTP.

The FTP server is 192.168.2.19

So if I write in IE or Firefox (ps file zilla does not work)

FTP://192.168.2.19  I get the list of files. but when I click on a folder or file, I get a time-out error.

so that if I do ftp://192.168.202.19 I don't even no initial registration.

If I look in the Juniper I can see data entry

So the problem seems to be coming back from the Juniper or cisco.

The FTP server is also part 3, so when I called the company to see if it is active or passive.  They said that it is both.

I guess that the problem comes from the Juniper but still take a chance

ASA Version 8.2 (1)
!
Terminal width 250
router host name
activate the encrypted password
encrypted passwd
names of
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.192.2 255.255.255.252
!
interface Vlan2
nameif outside
security-level 0
IP x.x.x.x 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
grp_outside_in tcp service object-group
Description Ports require for internal transfer
EQ smtp port object
EQ port ssh object
access list inside-out extended ip allowed any one
access list inside-out extended permit icmp any one
permit no_nat to access extended list ip 192.168.0.0 255.255.0.0 10.250.128.0 255.255.255.0
list access tunnel extended split ip 192.168.0.0 255.255.0.0 allow 10.250.128.0 255.255.255.0
access-list 101 extended allow ip 10.250.128.0 255.255.255.0 192.168.201.0 255.255.255.0
access-list 101 extended allow ip 10.250.128.0 255.255.255.0 host 192.168.202.19
access-list 102 extended allow ip 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0
access-list 102 extended allow ip 10.250.128.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 103 extended allow ip 10.250.128.0 255.255.255.0 host 192.168.202.19
access-list 103 extended allow ip 10.250.128.0 255.255.255.0 192.168.203.0 255.255.255.0
104 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.204.0 255.255.255.0
104 extended access-list allow ip 10.250.128.0 255.255.255.0 host 192.168.202.19
105 extended access-list allow ip 10.250.128.0 255.255.255.0 host 192.168.202.19
105 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.205.0 255.255.255.0
106 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.206.0 255.255.255.0
106 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.214.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.201.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.203.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.204.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.205.0 255.255.255.0
114 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.206.0 255.255.255.0
access-list 200 scopes allow ip 10.250.128.0 255.255.255.0 192.168.203.0 255.255.255.0
access-list 200 scopes allow ip 10.250.128.0 255.255.255.0 192.168.204.0 255.255.255.0
access-list 200 scopes allow ip 10.250.128.0 255.255.255.0 192.168.205.0 255.255.255.0
access-list 200 scope allow ip 10.250.128.0 255.255.255.0 host 192.168.202.19
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.201.0 255.255.255.0
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.203.0 255.255.255.0
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.204.0 255.255.255.0
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.205.0 255.255.255.0
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.206.0 255.255.255.0
400 extended access-list allow ip 10.250.128.0 255.255.255.0 192.168.214.0 255.255.255.0
access-list 201 extended allow ip 10.250.128.0 255.255.255.0 192.168.201.0 255.255.255.0
access-list 201 extended allow ip 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0
access-list 201 extended allow ip 10.250.128.0 255.255.255.0 192.168.206.0 255.255.255.0
extended access-list of 500 permit tcp 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0 eq ftp
extended access-list of 500 permit tcp 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0 eq ftp - data
extended access-list of 500 permit tcp 10.250.128.0 255.255.255.0 192.168.202.0 255.255.255.0 gt 1024

pager lines 34
Enable logging
timestamp of the record
debug logging in buffered memory
recording of debug trap
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
IP local pool mobilepool 10.250.128.100 - 10.250.128.130 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access no_nat
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
Route inside 192.168.2.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.201.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.202.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.203.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.204.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.205.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.206.0 255.255.255.0 192.168.192.1 1
Route inside 192.168.214.0 255.255.255.0 192.168.192.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
Enable http server
http 192.168.2.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-md5-hmac floating
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic dyn1 1 set transform-set floating
Crypto-map dynamic dyn1 1jeu reverse-road
mobilemap 1 card crypto ipsec-isakmp dynamic dyn1
mobilemap interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH 192.168.2.0 255.255.255.0 inside
SSH 192.168.192.0 255.255.224.0 inside
SSH 10.0.128.0 255.255.255.0 inside
SSH timeout 5
SSH version 2
Console timeout 0
dhcpd outside auto_config
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal mobilegroup group policy
internal mobile_policy group policy
attributes of the strategy of group mobile_policy
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value split tunnel

(User with the access restrictions section list)

type tunnel-group mobilegroup remote access
tunnel-group mobilegroup General-attributes
address mobilepool pool
Group Policy - by default-mobile_policy
mobilegroup group of tunnel ipsec-attributes
pre-shared key
!
Global class-card class
match default-inspection-traffic
inspection of the class-map
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:4d936450878b9803a1fdde1c7f0fd807
: end

I saw Application Layer Gateway (ALG of Juniper) give a problem with the FTP flow. Check to see if it is activated and flip on (or off) and try again your ftp.

ScreenOS 6 + (Netscreen firewall), the command is 'get alg '. For ScreenOS 5.4 or lower is a hidden command ' get the registry nat vector | I FTP ".

For the Juno (SRX Firewall) is to "see the alg decision."

Tags: Cisco Security

Similar Questions

  • Friend upgrade XP to windows 7. not authentic Windows message receipt. Buy Windows 7 and downloaded to "fix the problem".

    Friend upgrade XP to windows 7. not authentic Windows message receipt.  Buy Windows 7 and downloaded to "fix the problem". Computer crashed, but I got a new drive. Should I try install

    Hello

    So the Windows 7 machine is fine, but its also empty! That we can help you. The XP machine is another matter. If you want to upgrade these machines to Windows 7, and the minimum hardware requirement is met, you can buy discs of software of Windows 7 operating system for each machine (1 motherboard = 1 license for purchased software).

    In addition, I highly recommend you reformat two machines for them to XP RID completely, not to mention viruses / malware. If you plan to update the two XP machines with own versions of XP, that's fine, but this isn't the forum for this, the Windows XP forum would be the place, go here: http://answers.microsoft.com/en-us/windows/forum/windows_xp?tab=QnA .

    Thus, the machine to Windows 7. To take no chances. Allows to run several scans on the new machine. You said "didn't work any more", I suppose you can't start Windows, ways to correct? If so, the answer is a program you burn on a CD called BootMed; Download 64-bit here: http://download.cnet.com/BootMed-64Bit/3000-2094_4-75450831.html and the 32-bit version from here: http://download.cnet.com/BootMed/3000-2094_4-75448200.html (only use the Direct download link).

    Once downloaded, burn it to a CD, load this CD in Windows 7 computer and ensure that the CD drive is the first boot device, restart the computer. This will load a modified version of Ubuntu on your system, which includes antivirus and anti-malware programs. Run and remove anything they find. When they have finished their trial scans restarting the computer without the CD installed. What happens now?

    Post your results here and let me know how you fare.

    Kind regards

    BearPup

  • Access to the FTP Windows 7 problem

    Hello

    I use a newly installed version of Windows 7100 and cannot access an FTP site from Internet Explorer or FTP Client (Filezilla) program.

    Thanks to a tab of Windows Explorer, I get this message "windows cannot access this folder. Make sure that you typed the filename correctly and that you are authorized to access the directory. Details: operation timed out. "I connect with the username and password but still the same message.

    Through Internet Explorer, I can actually get on the site and access information, but when I click on 'page' 'ftp site open in windows Explorer' it gives me the same error as above.

    Thank you

    Open IE, Tools menu, Options, tab advanced click on "Reset".

    Messages rating helps other users

    Mark L. Ferguson MS - MVP

  • Access and download of files of cloud

    Hello

    (1) I downloaded files on my cloud from two sites (an active site and one I'll build).  However, I don't see how to access the files after the launch of Dreamweaver so that I can continue to build my site with my cloud files.  How/where do I type my cloud by Fireworks or Dreamweaver files?

    (2) as I worked in Dreamweaver that connects to a newly created folder that is located on my desktop, is it possible to download this file and it is contetnt to the cloud of a sudden, instead of the file by file?

    Thank you!

    Hi Mabletonga

    This could be useful for you about the recommended procedure

    Dreamweaver

    lyst-and-Dreamweaver-cs6-what-is-business-catalyst http://TV.adobe.com/watch/Introducing-Business-Catalyst/Getting-Started-with-Business-CATA

    lyst-and-Dreamweaver-cs6-creating-and-publishing-sites/ http://TV.adobe.com/watch/Introducing-Business-Catalyst/Getting-Started-with-Business-CATA

    With respect to the specifications on the publication of the entire folder on your desktop, could you post this question forums Dreamwever here:

    http://forums.Adobe.com/community/Dreamweaver/dreamweaver_general

    -Dave

  • You have help from Adobe to buy Adobe Stock last week but always can´t to access and download photos, what wrong?

    Do I have to activate the license somehow or / and add user specifik Adobe Stock? How do I do that?

    Tried to download photos via the administrator saccount both my personal account. In the list with the team members there are no licenses distributed to the function of Stock.

    Hello

    Subscription of Stock purchased is an individual subscription, doesn't not part of your plan of teams.

    Connect to stock.adobe.com with the ID used to make the purchase, and then select personal account see the attribution of the image

    Thank you

    Bev

  • I have problem in photoshop cc 2014, it does not open and when I try to open it, it gives me this massage: photoshop quit unexpectedly, I have tried several times to open it, even I uninstall and downloaded again, but the problem is the same

    Screen Shot 2014-11-09 at 12.01.33 PM.png

    And who says very clearly the SelectiveTool Nik/Google plugin crashes you.

    Will disable plugins Nik/Google and contact Nik/Google for updates.

  • Windows Explorer stops responding when you access file downloads

    I'm having a problem with the Windows Explorer does not when I try to access the downloads folder. The problem seems related to a file, a Java .exe file I downloaded. Explorer hangs up as soon as I try to do something with this file, I can't even remove it. I got out the folder other files in desktop and using research and move the file, but when I try to do something with this file, Explorer crashes again.

    No video file in the folder, the file problem seemed to be a Java update file. I managed to remove using an third-party uninstall program, and the problem seems to have disappeared. My best guess is that the update program has been altered during the download.

  • How to upload and download file of the domain

    Hey

    I have a problem - I need to send large files to someone else on the internet - then I want to upload them to my area for them to access and download works fine when I put a .jpg and .psd but when I zip it together I can't download the zip file. And I checked the URL to ensure that right. Anyone know what I'm doing wrong... ?

    That's what I'd do, Yes.

    But before we do, can you give us a link to the zip file so that we can check this?

  • IP overlapping between VPN remote access and within the interface

    Hi all

    I tried to replace an ASA and configured vpn for remote access using cisco VPN client.

    Remote access users are not able to access within the network, but have no problem accessing the network through a VPN site-to site.

    One thing to note is that remote access VPN users are assigned an ip address of 10.X.3.1 - 10.X.3.200 mask 255.255.255.0. The inside interface is on 10.X.1.2 255.255.0.0.

    Remote access users will have no problem to access within the network if the pool of the vpn client is changed to 192.168.1.1 to 192.168.1.100.

    ASA errors

    6 January 7, 2012 16:25:08 302013 10.X.3.1 27724 3389 10.X.1.66 built of TCP connections incoming 20940 for outside:10.X.3.1/27724 (10.X.3.1/27724)(LOCAL\Cisco) at inside:10.X.1.66/3389 (10.X.1.66/3389) (Cisco)

    6 January 7, 2012 16:25:08 106015 10.X.1.66 3389 10.X.3.1 27724 Deny TCP 10.X.1.66/3389 to 10.X.3.1/27724 flags SYN ACK on dmz interface (no link)

    I understand that the overlap between access ip address range remote vpn network interface network and inside will cause routing problems, but why the syn - ack makes its appearance in the DMZ interface? The interface of the DMZ is on ip address 172.16.Y.1 255.255.255.0.

    I intend to reduce the interface 10.X.0.0 255.255.254.0 inside if it is in fact a routing problem due to the IP address that overlap, but I understand why the syn - ack comes from the dmz interface and the diagnosis of the problem is correct. I check with the customer and was informed that the existing design works on an another ASA with no such problems.

    I agree what you said and also tried, but it does not work.

    http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807e0aca.shtml#overlap

    Solution, that you already know

    Solution

    Always ensure that the IP addresses in the pool should be assigned to VPN, network clients internal head unit and the internal network to the VPN Client must be in different networks. You can assign the same major network with different subnets, but sometimes the routing problems.

    Thank you

    Ajay

  • I just tried to open Photoshop CS6 and received the message that photoshop has encountered a problem wth the display driver and has disabled the improvements by using graphics hardware. Where can I access the update to correct the problem that t

    I just tried to open Photoshop CS6 and received the message that photoshop has encountered a problem wth the display driver and has disabled the improvements by using graphics hardware. Where can I access the update to fix the problem because the link does not show?

    You will have to go the website of the manufacturer of your graphics card and download the current drivers.

  • Export and download Muse site problem

    Hello

    I just finished my site in Muse, everything works correctly in the window Business Catalyst, but many will not, as soon as I have the export, load it with Dreamweaver.

    I have a few "403 forbidden" with additional error "404 not found" pages, a page appears as if she did not get the CSS... The strange thing is that I deleted this on local and remote servers to make a pure transfer and errors appear again, but on different pages, while those who were not working only not previously are well again!

    I really don't understand what's happening, it's as if some files do not download, but I don't have the error messages.

    I compared the local and remote files: they are identical.

    It is not the first site that I create with Muse and I never encountered this problem before... I've looked through the forum, but have not found an answer... What I'm doing wrong, have I missed something?

    Any help would be greatly apreciated.

    Thank you!

    Hello

    Can you publish the site on Business Catalyst as a place to test and see if it looks good? If it seems very well, then the problem may be with the download, host that you upload to. You can try to download directly to the host of Muse to see how it goes? Or you can use an external FTP client like Filezilla once and see if that fixes the problem.

    I hope this helps.

    See you soon.

  • problem with windows 2003 vpn servers. and xp pro clients vpn using bridge nic

    I have installed 2 guests windows 2003 on 2 laptops. both are configured with 1 CC of backend and frontend 1 nat/vpn server that has 2 interfaces, a bridge and one configured for host only.

    I configure nat on both servers windows 2003 rras and vpn services and have them connected to my local network. they are able to access internet, ping between them and other computers on the network, as well as the host systems on which they run.

    the problem is that I am not able to connect to the vpn servers remotely from inside a guest virtual machine. I wanted to try a vpn site-to site between the guests 2 windows 2003, but the operation failed.

    I then tested customer to type of a guest virtual computer pro xp vpn server. It is also a failure.

    but I discovered that if I initiate a VPN from any one of the host computer system laptop or another computer on the physical network I am able to connect to the vpn servers I have set up.

    I wish I could have these laptops to operate normally and

    time to time be able to turn on virtual machines with vpn

    servers and test as dfs things and replication active directory as if

    they were running 2 separate real-world offices. the two laptops have invited Setup for 192.168.0.0 networks with subnet mask 255.255.255.192. each host that it supposed to be running a 1 subnet for the popular virtual machine with the servers vpn/nat connect together the 2 sites.

    laptop computers are running xp pro and vista ultimate as the host systems. I'm only using the windows firewall but also tested with them disabled vpn connections. also launches the service ipsec on laptops to secure internal lan traffic, I have also tested with two guests with disabled ipsec.

    is there something I'm missing here with the installation of the vmware bridge network?

    Oh I forgot to mention, I test using pptp and ms-chap v2

    I managed to do work by unchecking the tcp/ip settings and the microsoft file sharing on the bridged NIC resaeau.

    now it works very well but who explain to me why it cannot work when you are using the same network as the host card. they all have two different ip addresses and mac addresses. but something seems to be in conflict

  • new downloads cause a continuous scroll effect. currently have 12.0 and doesn't have this problem. have a brain injury and cannot have this fast scrollin

    new downloads cause a continuous scroll effect. currently have 12.0 and doesn't have this problem. have a brain injury and cannot have this fast scrolling
    each time new updates are coming they seem to cause scrolling the page.
    I need a mobile page where I'm in control of how it moves.
    I'm afraid that if I don't keep current updates that computer security will be compromised.
    Thank you
    P.

    Where do you find this scroll?

    Is it in a browser window or in the Download Manager window or another?

    Start Firefox in Safe Mode to check if one of the extensions (Firefox/tools > Modules > Extensions) or if hardware acceleration is the cause of the problem (switch to the DEFAULT theme: Firefox/tools > Modules > appearance).

    • Do not click on the reset button on the start safe mode window or make changes.

    Please upgrade as soon as possible to the current version if you have downgraded because of this problem.

    If there is a problem with scrolling on web pages, then try to disable smooth scrolling.

    • Tools > Options > advanced > general: navigation: "Use smooth scrolling".
  • My whatsapp necessary updated and I had problems making inturn I reset everything on the iphone5 he says my whatsapp was purchased and download free of charge despite being there download it still only downloads help please

    My whatsapp necessary updated and I had problems making inturn I reset everything on the iphone5 it says my whatsapp was purchased and download free of charge despite being there download it still only downloads help please what should I do

    Look for its requirements.

    I remember something similar happening to a friend of mine, but the sound of it, your phone can be updated. Aka what stop app works with earlier versions.

    But search for it in the app store to see its requirements! It will tell you!

  • Diagnostics Windows network, the error reads 'Problem with wireless adapter or access point' and fails to solve the problem.

    «Problem with access point or wireless adapter»

    Hi, I just bought a new laptop & I have the extreme difficulty to stay connected to the internet. When I run Windows Network Diagnostics, error reads 'Problem with wireless adapter or access point' and fails to solve the problem. Help, please... Thank you, Maria

    HI Maria,

    ·         What operating system is installed on your computer?

    ·         You have installed the latest drivers for wireless network card?

    Follow the suggestions below for a possible solution:

    Method 1: Start your computer in a clean boot state in order to check if the applications of third parties or startup items is the origin of the problem.

    How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

    http://support.Microsoft.com/kb/929135

     

    Note: After troubleshooting, make sure that you configure the computer to start as usual as mentioned in step 7 in the above article.

    Method 2: See these articles for solve wireless problems:

    Why can't I connect to the Internet?

    http://Windows.Microsoft.com/en-us/Windows7/why-can-t-I-connect-to-the-Internet

     

    How can I troubleshoot network card?

    http://Windows.Microsoft.com/en-us/Windows7/fix-network-adapter-problems

     

    Windows wireless and wired network connection problems

    http://Windows.Microsoft.com/en-us/Windows/help/wired-and-wireless-network-connection-problems-in-Windows

    Let us know if that helps.

Maybe you are looking for