« Previous Next »

• 10-22-2009, 10:56 AM

  icnventures Joined on 10-22-2009, 2:55 PM Posts 4

  setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact I am trying to set up an ftps server using IIS 7.5 so a vendor can post large files to our servers.  I have installed everything and it seems to be working for my point of view.  I have installed coreftp and filezilla on my PC and I am able to login and transfer files.  However when my vendor logs in they are having some issues that I can figure out.  Windows firewall is turned off and the public firewall is doing a port forward.  I am going to post his email.  I first did a test to replicate your symptoms.  It timed out after five minutes.  I increased the time out value to ten minutes (600 seconds).  I got a response from that server after three minutes which reset the timer but it timed out after ten minutes.  Then I looked closer at the server messages.  Their PASV message contains their public IP address (x.x.x.x) and the port is in the range they specify (49152-65535).  Everything is fine so far. However, the server message received to both a Passive and Active mode is the same.  We should be getting an immediate reply code (125) stating the listing has started. I did a packet trace which shows the mainframe sends out the data channel connection attempt (SYN packet) six times but never gets a response (SYN ACK packet) before it times out. I do not know if their firewall is blocking the data channel connection attempt or their server isn’t responding or if its response is not making it back through their firewall.  With the 150 message indicating it is trying to connect to us as if this were Active mode, the server may not be operating properly.   Set timer value to ten minutes (default is five) ftp -x –r tls url.url.com (ti 600 get logged in fine and data channel is set to secure.  Do ls (list) which works the same as a GET locsite FWF             set Passive mode EZA1460I Command: ls EZA1701I >>> PASV 227 Entering Passive Mode (x,x,x,x,194,218).   Public IP x.x.x.x and port 194x256+218=49882 EZA1701I >>> NLST 150 Opening ASCII mode data connection.    received after three minutes which resets timer.  BUT.. see Active mode below *** 10 minutes pass *** EZA2589E Connection to server interrupted or timed out. Waiting for reply EZA1721W Server not responding, closing connection. EZA1460I Command: However, when I use Active mode ls EZA1701I >>> PORT 166,37,192,3,168,200 200 PORT command successful. EZA1701s >>> NLST 150 Opening ASCII mode data connection    same server message EZA2589E Connection to server interrupted or timed out. Waiting for data connection 550 EZA1460I Command: quit EZA1701I >>> QUIT 221 Goodbye. READY Secure Passive FTP connection from OZZ2 to OPS1: ls EZA1701I >>> PASV 227 Entering Passive Mode (166,37,128,66,10,109) EZA1701I >>> NLST 125 List started OK    should be getting something like this back EZA2284I BRODCAST.LIST EZA2284I FTP.ROLL.OBEY1 EZA2284I FTP.TEST.BATCH EZA2284I FTP.TEST.FIFTY

  Tags: ftpsIIs 7.5passive mode

• 10-24-2009, 11:06 PM

  In reply to

  steve schofield Joined on 06-10-2002, 4:54 PM MI Posts 3,963	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact When using passive ports, the firewall needs to allow the connection.  I'd verify on their end. Steve Schofield Windows Server MVP - IIS http://weblogs.asp.net/steveschofield http://www.IISLogs.com Log archival solution Install, Configure, Forget

• 10-24-2009, 11:09 PM

  In reply to

  Sansom Joined on 11-14-2006, 3:57 AM Bangalore Posts 22

  Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact Make sure we set the address of the firewall in the IIS FTP firewall settings. Try reaching this server from a client which is part of the same subnet so that you can bypass the firewall. Check this blog at http://blogs.msdn.com/sansom/archive/2009/10/24/sample-tool-for-testing-secure-ftp.aspx for a sample secure FTP client that you use for testing. Cheers, Santhosh visit my blogs at http://blogs.msdn.com/sansom

• 10-25-2009, 2:37 PM

  In reply to

  icnventures Joined on 10-22-2009, 2:55 PM Posts 4

  Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact Thanks for the post!!!!!  I am able to connect from my PC which is outside the firewall and from my other servers or from VPN inside the network.   The problem is from the Vendor system and appears to be a issue communicating back through there firewalls.   I have set up ports 49152 through 50000 as the data channel ports in IIS and I have set up a firewall rule to forward all traffic on those ports to the server.  My firewall is setup using Mapped IP's.   At first I though maybe the packets coming from the server to the firewall where encrypted so it was having issues sending them back to the client with the correct Public IP in the header.  But I just ran a wireshark from my PC to the system and it works but I noticed that the PC sends traffic on port 49152 and the server is sending packets back on a different port but with the public IP.  I am thinking there servers have that port closed because the connection was not estiblished on that port.  What do you think?  If that is the problem do you have any suggestions on fixing so the data channel is sent and recieved using the same port.

• 10-26-2009, 6:49 AM

  In reply to

  Sansom Joined on 11-14-2006, 3:57 AM Bangalore Posts 22	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact client side firewall should allow connecting to the data ports the server is configured to listen. A network trace should help you see the TCP handshake to the data port. If the handshake has failed this could very indicate the client firewall settings. Cheers, Santhosh visit my blogs at http://blogs.msdn.com/sansom

• 10-26-2009, 8:45 PM

  In reply to

  icnventures Joined on 10-22-2009, 2:55 PM Posts 4

  Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact There network is only configured to do explicit passive connections to our servers.  I think IIS is trying to connect in active mode.  I did a wireshark on both ends with my pc and server and it looks like PC is connecting on one port and the server is sending data back on another port.  Is there a setting in IIS to make sure passive mode is used and to turn off active mode?

• 10-26-2009, 9:14 PM

  In reply to

  steve schofield Joined on 06-10-2002, 4:54 PM MI Posts 3,963	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact Take a look at this article. http://learn.iis.net/page.aspx/309/configuring-ftp-firewall-settings/ Steve Schofield Windows Server MVP - IIS http://weblogs.asp.net/steveschofield http://www.IISLogs.com Log archival solution Install, Configure, Forget

• 10-26-2009, 10:39 PM

  In reply to

  qbernard Joined on 03-26-2003, 2:12 AM Malaysia Posts 3,229	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact IIS has not control on its mode, it is specify by the client side.  icnventures: .  Is there a setting in IIS to make sure passive mode is used and to turn off active mode?  Cheers, Bernard Cheah

• 10-27-2009, 2:40 AM

  In reply to

  Sansom Joined on 11-14-2006, 3:57 AM Bangalore Posts 22

  Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact From a server side configuring Passive Port range is required to force IIS to passive FTP. On the client side, the setting in Internet Explorer "Use Passive FTP (for firewall and DSL modem compatibility)" controls the use of this mode. Toggle this to see if it helps Cheers, Santhosh visit my blogs at http://blogs.msdn.com/sansom

• 10-28-2009, 1:45 AM

  In reply to

  qbernard Joined on 03-26-2003, 2:12 AM Malaysia Posts 3,229	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact huh? configuring passive port range only instruct IIS to uses those port range during passive mode, however the client still control of the transfer mode. Cheers, Bernard Cheah

• 10-28-2009, 8:32 AM

  In reply to

  icnventures Joined on 10-22-2009, 2:55 PM Posts 4	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact Thanks everyone for the post!!! I think I have solved the problem for this vendor.  I created a firewall rule for there IP address to allow all source ports and set the destantion ports to make my settings in IIS firewall settings.  I appriecate all the help. Chris

• 10-28-2009, 8:37 PM

  In reply to

  qbernard Joined on 03-26-2003, 2:12 AM Malaysia Posts 3,229	Re: setting up ftps on IIS 7.5 using Explicit/passive modes Reply Contact Awesome, thanks for the update. Cheers, Bernard Cheah