Have you enabled FTP inspection on the ASA.

Do the following:

ASA(config)#policy-map global_policy
ASA(config-pmap)#class inspection_default
ASA(config-pmap-c)#inspect FTP

If the above does not work, then try the following command:

ASA(config)#ftp mode passive

Hi, i used this article as a guide and got my network up and running properly. I have now discoverd a problem with FTP. I have an FTP server in my inside network in passive mode. On the ASA i have static NAT translations- port 21 and 20 to my internal server- also have port 20 and 21 open on the outside interface. Problem is when I connect from a FTP client from outside I can connect to the server just fine- I get asked for authentication but then the connection breaks. For what I;ve been reading it’s because the server in passive mode uses random ports to transmit the data, and those ports are obviously not allowed on my ASA. The asa should be able to inspect the data and let it through.. any ideas of how to do this? I’ve been looking everywhere and can’t get it tow work. A bit of help would be greatly appreciated.
Kind regards

Fernando

As I have already said on my previous comment, it would be better and easier to disable NAT on the ASA. This will make the ASA work like a router but still inspecting traffic and applying firewall rules to traffic. Connect the outside interface of ASA to the inside of router, and the inside interface of ASA to vlan1 of the 4006 switch. You will need to introduce a new layer3 subnet to accommodate let say the subnet between outside ASA and inside of router. The inside of ASA and vlan1 can stay as 172.16.1.0/24. On the ASA, router and 4006 you will need to add the required static and default routes.

You will disable NAT completely on the ASA (so there will not be any static NAT to itself like my example above). Think about it as if you are placing a normal router in front of the switch.

Didn’t understand exactly what you want to achieve. Be more specific please

I suggest to disable NAT on the ASA (“no nat-control”) and do all the NAT on the router. This will be the simplest scenario. You can have a static NAT on the router mapping one static public IP to the internal server 192.168.1.100. Then have the ASA control the traffic to the internal server with access list applied on its outside interface. You must put the proper static route also on the router for the internal servers which are behind the ASA.

I think it would be easier for your scenario if you disable NAT completely on ASA (using “no nat-control”) and you have the ASA working as a router. Ofcouerse it will continue inspecting traffic and doing its firewall job, but it will not do any NAT. Since all the nat is done on your border router, you don’t need another NAT device. You will have to control traffic on the ASA just by using Access Lists.