topic Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?) in General Topics

Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

jornt.weyts — Wed, 16 Nov 2011 11:02:25 GMT

After upgrading to version 4.1.0 on my PA2050 in HA (Active-passive) passive FTP is no longer possible to our FTP server.

When users logon they timeout on the MLSD command (in binary mode)

I'm looking at NAT because the issue does not arise when accessing the same server from within the network. The FTP server is in the DMZ and doesn't NAT for internal users, but it has a bi-directional NAT behind a static public IP for untrusted users.

Active FTP works fine.

I did remove the vulnerability profile to test: problem still exists

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

jornt.weyts — Wed, 16 Nov 2011 12:09:12 GMT

surfright1 appears to have had the same issue forcing him to downgrade.

Problem with MLSD command on FTP after upgrade to 4.1.0

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

mharding — Wed, 16 Nov 2011 14:00:37 GMT

I've seen this happen before on other PAN-OS releases. This first time I was able to just reinstall the OS, and that fixed it. The next time it happened support had me run a command to either clear or reset the NAT pool, but I can't find the command anywhere.

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

cenders — Wed, 16 Nov 2011 16:41:39 GMT

I am having the same problem as well.

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

ERIKS — Tue, 22 Nov 2011 12:43:42 GMT

I am also seeing this issue with some internet based users trying to ftp to servers on our DMZ and using passive mode.

This is effecting business critical servers as we are using ftp for some of our EDI orders.

I would rather not have to down grade back to 4.0.7 as 4.1 fixes some other issues that we were having with VPN connections.

Can anyone from Paloalto Networks tell us how long are we likely to have to wait before we see a version 4.1.1 to fix this issue please?

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

cenders — Tue, 22 Nov 2011 15:52:11 GMT

I was just notified that the bug has been fixed in the 278 Content version. I have not yet confirmed this as the 278 isn't available for download/install yet.

When it is available, you will go to Device -> Dynamic Updates. At the bottom of the screen press "Check Now" to update the page with the latest release information. Under Applications and Threats check for 278 or greater and download/install.

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

bpappas — Tue, 22 Nov 2011 22:35:17 GMT

content version 278 appears to be available for download at this time on the update servers.

-Benjamin

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

ERIKS — Wed, 23 Nov 2011 09:12:04 GMT

I've upgraded the Application and Threat content to version 278 and in my tests this problem still exists.

It would appear that it allows the ftp file upload but the file is corrupted and the ftp session itself will hang and has to be forced closed.

Come on Palo we need a fix for this ASAP please. This is seriously going to impact our business communications.

Re: Passive FTP issue after upgrade to v4.1.0 (NAT issue?)

rjkhatri — Tue, 13 Dec 2011 13:48:29 GMT

We had the same problem as well for a couple of weeks and problem was resolved after Content Update 278.