Firewall and ftp

[Sampath_Rook]

How to check if the firewall is causing ftp timeout.

[Ivan Ferreira · Accepted solution]

Run telnet to the port 21, for example:

telnet ftpserver 21

If you get answer, at least port 21 is open. If you can connect, but you cant issue commands or they hangs, then the problem is that port 20 is blocked. Use passive mode.

[Sampath_Rook]

Hi
The architecture is that i am working on a mediation application that gets the files from the switches in the network for billing,now the application would wait for some time for the switch to respond,but now the ftp timeout period expires and the files are not ftp'd from the switch.the protocol used is XFERRBF.

[Sampath_Rook]

I just want to check if the firewall which is sitting between the switch and the application causes this problem or not.

[Sampath_Rook]

i checked it, i am able to access the server

[Sampath_Rook]

I have to go to a firewall to access the ftp server, does the firewall cause a ftp timeout, can anyone help please

[Ivan Ferreira]

Can you provide a little more detailed information about the problem? For example, have you tried to run ftp and get some files interactivelly? Can you transfer at least one file, when it times out? After a long idle session or when trying to get a file?

[Sampath_Rook]

Yes, I can get files, but when the application tried it automatically it fails for come reason,it just doesnt happen on one server , but on different ones.So i think there no problem in getting files manually, but the probelm is when it tries to reach automatically
the traceroute results is

traceroute to 10.196.34.156 (10.196.34.156): 1-30 hops, 38 byte packets
1 10.196.34.156 (10.196.34.156) 2.93 ms * 1.95 ms

[Mark Poeschl_2]

If your interactive session is working, it doesn't seem very likely that the firewall is the source of your problem.

You might try tracing the packets of a (sucessful) interactive session compared to an (unsuccessful) non-interactive session.
Here are the commands:

# pfconfig +p +c

# tcpdump -i -s 128 -w host 10.196.34.156 &





# tcpdump -i -s 128 -w





# pfconfig -p -c

This will create two files - outfile1 and outfile2 - containing the packets exchanged between your server and the FTP server. You can use 'tcpdump -r ' to generate human readable versions of the packets collected.

[Mark Poeschl_2]

Ooops - forgot the 'host 10.196.34.156 &' in the second tcpdump command.

[Ivan Ferreira]

Can you add a output redirection to your script to try to identify what is the final problem, for example, if your script is called ftp_get.sh, modify to run like this:

ftp_get.sh > /tmp/ftp_get.log 2>&1

So, there will be able to identify where the time out occurs, at connection, after the connection, or if another error happens (Maybe name resolution?).

As said before, if you can transfer files manually or interactivelly, then the firewall is not the source of the problem.