[FW1] Problem with FTP PORT command and NAT

[Markus Hofbauer <ho@FW1-NOSPAMbacher.at>]

Hi,

I tried to open a ftp connection from an internal host (NAT)to an 
external ftp server. 
The control connection workes well (login) but when I do a data 
connection (eg. ls) there is no control connection avaliable.

fw monitor shows that the FW-1 does wrong NAT:

........................................................................ 
91 0.00000 internal-host -> official-ftp-server FTP C port=3785 
PORT 10,200,10,102,1 
		0: 6f00 7362 6966 3300 		o.sbif3.

92 0.00000 193.187.200.50 -> official-ftp-server FTP C port=3785 
PORT 10,200,10,102,1 
		0: 4f00 7362 6966 3300 		O.sbif3. 
........................................................................

You can see that in #92 there should be the translated (official) IP of 
the internal host as argument of the PORT command.

After reinstalling the policy the problem is solved. But this happened 
several times in the past two month.

Thanks for your reply, 
markus



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================