Can't access an FTP Site from the inside

[stevenriz]

I know this may be a Solaris issue but I am leaning towards the PIX on this particular issue. Maybe you can help. Let me try and explain this clearly.

We have two subnets within the PIX, 192.168.1.0 and 192.168.2.0. Gateway to the outside is ultimately the PIX at 192.168.1.10. 192.168.2.10 for the .2 net. 192.168.1.10 is on the ISP router.

ip address outside 'publicip' 255.255.255.240
ip address inside 192.168.2.10 255.255.255.0
ip address vpndmz 172.16.2.1 255.255.255.0
ip address corp 192.168.1.10 255.255.255.0

We have two servers both on the .2 subnet. Both of which MIND YOU "CAN" ping this FTP site, only one of the machine "DOES NOT" receive a login prompt to the FTP site.

One Solaris machine on the .2 net "CAN" access this particular FTP site on the net. It's netstat -nr shows like so...
Routing Table: IPv4
Destination Gateway Flags Ref Use Interface
-------------------- -------------------- ----- ----- ------ ---------
192.168.2.0 morpheus U 1 46 hme0
224.0.0.0 morpheus U 1 0 hme0
default 192.168.2.10 UG 1 103
localhost localhost UH 8 48133 lo0
#

Now this second machine which is on that same .2 net is a Solaris box as well. The issue is it "CANNOT" access this particular FTP site. The FTP login prompt is not returned. Here is the netstat -nr on that machine...
Routing Table: IPv4
Destination Gateway Flags Ref Use Interface
-------------------- -------------------- ----- ----- ------ ---------
192.168.2.0 192.168.2.162 U 1 208 hme0
224.0.0.0 192.168.2.162 U 1 0 hme0
default 192.168.2.10 UG 1 13
127.0.0.1 127.0.0.1 UH 4 252948 lo0
#

The difference with the later server is that I publicize it on the web so it has a public IP address attached to it using an access list and static routes. I also gave it the "alias" command thinking that would have fixed it. It didn't.

Do you think my problem is with the PIX? I am looking for clues but cannot find any. The Solaris versions are different. But I have some Boxes on the older version that "CAN" access this site. I am still tinkering with this but I thought I would ask so not too much more time is wasted working on this... Thanks all!!
Steve

 

[stevenriz]

I just thought of something else.

I believe the company hosting this FTP site uses IP address security so I gave them the NAT IP Address. Now if I am publicizing some servers, what does the IP address appear to be from those servers? I was thinking it will still appear to be the NAT address because the connection is initiated from the inside out, not from the outside in. Am I wrong?

Thanks!
Steve

 

[NetworkDOC]

Your external address will be the one seen from the outside.

Your one box can get out but the other can't. One has a static translation rule and the other doesn't. Did I follow that correctly?

If so... Then it sounds like you do not have a global address for internal users to go out on. That and a nat statement for them to be translated etc.

Also... If you are using say a 10 user lic on the pix and you have maxed out you won't get out with #11. Do a show ver on the pix and look for the # of licenses you have to confirm.

 

[stevenriz]

Well no we have a 515 UR PIX so it isn't a license issue. We do have a global NAT statement...
global (outside) 1 pub.ip.add.110 netmask 255.255.255.240

but the private IP addresses that I made public using a static route and access lists is what I was thinking would make this happen. You see the FTP site only accepts connections using IP addresses in an access list. So I gave this FTP site the IP address of pub.ip.add.110. Not the public IP address of the system I am trying to access it from... pub.ip.add.107 ... Am I clear enough? Maybe we are even in agreement. yes?

 

[NetworkDOC]

If their access list is looking for pub.ip.add.110 and you are coming from pub.ip.add.107 then yes you would get blocked.

So in a nutshell if you cannot get the logon prompt from the second pub.ip.add.107 you must simply have them add that to their access list to allow you in. Or you could have them open a range within your public ip space.

 

[stevenriz]

That is what I was thinking as well. I am waiting for them to open up 107 to see if that works. I'll let you know, thanks for the second set of eyes!!
Steve