• All
  • Test
  • Startup
  • Experience Case
  • FAQ
Product line
Documents type

SecPath F1000-C8150(V7)The external network access to the internal network ftp server fails to connect for the first time

2020-03-24 18:41:11 Published
  • 0Followed
  • 0Collected ,687Browsed
郭尧 5level
fans:1 follow:0

Network Topology

Public network-F1000-Core SW-ftp server


The firewall makes ports to perform source-to-address address translation to enable external networks to access internal servers

Problem Description

When the external network accesses the internal FTP server, the FTP software connection is rejected for the first time, and you need to refresh and reconnect to connect successfully

Process Analysis

Collect firewall diagnostic information, check the configuration of the external network interface, and map the nat server port to the internal FTP server. The configuration is as follows:

interface GigabitEthernet1/0/2

 port link-mode route

 description Telecom fixed extranet

 mtu 1460

 ip address

 ip address sub

 tcp mss 1280

 nat outbound

 nat server protocol tcp global 9091 inside 21 rule jf双向 counting


The interface configuration shows that the port of the FTP server has been changed to 9091 and the default port number of FTP is 2021. 

View the firewall session information during the first access. The session can be established normally, but one packet is lost.


NAT server address translation actually works, let's analyze the principle of FTP: First of all, FTP has the difference between active mode and passive mode. The first active mode analysis: The active mode works by the FTP client sending a PORT command to the server to tell the server the temporary port number that the client uses to transmit data. When data needs to be transmitted, the server establishes a data transmission channel through the TCP20 port and the client's temporary port to complete the data transmission. This temporary port is calculated by P1 * 256 + P2. The PORT command mainly sends this parameter, the format is (x, x, x, x, p1, p2) x, x, x, x is the server IP, and p1, p2 are the parameters randomly generated by the server.

At this time, we found that if the port number of the client's data connection is changed, and the server is blocked by the NAT device, the server knows the port number, but the NAT device does not know. If the FTP port number is not changed, the NAT device The received packet is a packet whose source port is a newly calculated port number, and the first source port number of the data connection is 20. At this time, the packet cannot be sent to the client through the router. Because there is no NAT Session, this This is the case of the active mode.  

Analysis of the second PASV mode:  

The previous control connection is basically the same, except that the last message of the control connection is that the FTP server sends the PORT parameter to the client, and then the client uses the temporary port number calculated by this parameter to initiate a data connection to the internal network. If the same NAT device does not know the modified FTP service port, then the temporary port used by the client cannot be calculated by ALG to generate a NAT session. 

 The working principle of NAT ALG is that in the active mode of FTP, when the last control connection message is sent, the PORT command of the message is checked, and the new port number generated by the PORT parameter is taken out to generate a NAT session. A prerequisite for this is that NAT ALG must recognize that this packet is a FTP control connection, and the basis for distinguishing this packet is the port number. Therefore, in the packet whose destination port number is 21, we consider it to be an FTP service. For NAT ALG to work properly. If we change the FTP port number, there will be problems when establishing a data connection.


Through the above analysis, we already know the reason why the data connection cannot be established, because we cannot recognize the packets that have been modified to control the port number of FTP. NAT ALG cannot work normally. If we can make the router recognize FTP Control the connection packet, then the problem will be solved, the firewall can achieve this requirement by configuring a common port, as follows:


The port-mapping command configures general port mapping.


Use the undo port-mapping command to delete the specified general port mapping.



 port-mapping application application-name port port-number [protocol protocol-name]

 undo port-mapping application application-name port port-number [protocol protocol-name]

 [Default situation]

 Each application layer protocol is mapped to its corresponding well-known port number.


 System view

 [Default user role]




application application-name: Specifies the application layer protocol for port mapping. application-name indicates the application protocol name. The value is a string of 1 to 63 characters, which is not case sensitive. Invalid and other are not allowed to be reserved for the system. The application layer protocol name must be standard and recognized by the device.

port port-number: Specifies the port to be mapped to the application layer protocol. port-number specifies the port number, which ranges from 0 to 65535.

 protocol protocol-name: specifies the transport layer protocol name used by the application layer protocol. Its value and meaning are as follows:


· Dccp: Datagram Congestion Control Protocol (DCCP).


· Sctp: Stream Control Transmission Protocol (SCTP).


· Tcp: TCP protocol.


· Udp: UDP protocol.


· Udp-lite: UDP-Lite protocol.


User guides

 If the protocol parameter is not specified, all specified packets of the transport layer protocol can be identified as packets of the specified application layer protocol.

 If the destination port number of a message matches a general port mapping, the message will be identified as a corresponding application layer protocol message.

For two configurations with the same port number and transport layer protocol parameters but different application layer protocol names, the new configuration will overwrite the original configuration.

Mappings that specify a transport layer protocol name take precedence over mappings that do not specify a transport layer protocol name.


 # Establish a common port mapping from port 9091 to the FTP protocol.

 <Sysname> system-view

 [Sysname] port-mapping application ftp port 9091

Please rate this case:   

No comments

Add Comments:



侵犯我的权益 >
对根叔知了社区有害的内容 >



泄露了我的隐私 >
侵犯了我企业的权益 >
抄袭了我的内容 >
诽谤我 >



您好,当您发现根叔知了上有泄漏您隐私的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您认为哪些内容泄露了您的隐私?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)



您好,当您发现根叔知了上有关于您企业的造谣与诽谤、商业侵权等内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到 zhiliao@h3c.com 邮箱,我们会在审核后尽快给您答复。
  • 1. 您举报的内容是什么?(请在邮件中列出您举报的内容和链接地址)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
  • 3. 是哪家企业?(营业执照,单位登记证明等证件)
  • 4. 您与该企业的关系是?(您是企业法人或被授权人,需提供企业委托授权书)






您好,当您发现根叔知了上有诽谤您的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您举报的内容以及侵犯了您什么权益?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)



不规范转载 >






Login before you can operate!