topic Re: Problem with MLSD command on FTP after upgrade to 4.1.0 in General Topics

Problem with MLSD command on FTP after upgrade to 4.1.0

surfright1 — Sat, 12 Nov 2011 10:39:51 GMT

Hi everybody,

After waiting a week I upgraded one of our PA-500 boxes to software version 4.1.0.

One of the services that are no longer working correctly is FTP. The MLSD command is causing an error at the client connecting to the service:

Status: Resolving address of mev.blahdieblah.com

Status: Connecting to 87.249.xxx.xxx:21...

Status: Connection established, waiting for welcome message...

Response: 220 Hello

Command: USER xxxx

Response: 331 Password required for amag

Command: PASS *******

Response: 230 Logged on

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory.

Status: Directory listing successful

Status: Retrieving directory listing...

Command: CWD Blah

Response: 250 CWD successful. "/Blah" is current directory.

Command: PWD

Response: 257 "/Blah" is current directory.

Command: TYPE I

Response: 200 Type set to I

Command: PASV

Response: 227 Entering Passive Mode (87,249,xxx,xxx,20,176)

Command: MLSD

Error: Connection timed out

Error: Failed to retrieve directory listing

This was working before with software version 4.0.5 - nothing has changed except the software on the Palo Alto firewall.

Anyone have an idea how to troubleshoot and fix this?

Thanks!

Mark

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

surfright1 — Sat, 12 Nov 2011 17:02:27 GMT

Because the firewall is part of a critical system I was forced to downgrade the device back to 4.0.5. Please look into this issue Palo Alto Networks. Version 4.1.0 is not usable in a production environment.

Mark

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

bpappas — Sat, 12 Nov 2011 19:44:23 GMT

I encourage you to contact your Authorized Support provider to open a case for this issue.

This will help us to determine the root cause of the issue. The information that you have provided might be enough for us to replicate this in our lab, but having a case open will help us track the issue and determine all of the variables (hardware, content version, etc. etc)

Thank you,

Benjamin

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

Phillip_Dixon — Mon, 14 Nov 2011 14:57:55 GMT

Got the same here.

(000180)14/11/2011 14:52:31 - user (81.179.47.27)> 230 Logged on
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> opts utf8 on
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> 200 UTF8 mode enabled
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> PWD
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> 257 "/" is current directory.
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> CWD /
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> 250 CWD successful. "/" is current directory.
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> TYPE A
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> 200 Type set to A
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> PASV
(000180)14/11/2011 14:52:31 - user (81.179.47.27)> 227 Entering Passive Mode (xxx,xxx,xxx,xxx,247,129)

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

Phillip_Dixon — Mon, 14 Nov 2011 17:21:14 GMT

Upon further investigation I seem to have a problem with selective customers.

When trying to open the FTP site using soemthing like filezilla it works. If I use Internet Explorer in passive mode it connects but cannot read the contents of the folder. Internet Explorer in active mode works no problem.

Therefore is it a problem using passive mode some how?

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

Phillip_Dixon — Wed, 16 Nov 2011 08:38:26 GMT

I have also had to downgrade to a prior version. Couldnt get version 4.1.0 to work correctly with FTP.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

bG-rgb — Wed, 16 Nov 2011 11:51:13 GMT

Same thing for us: ftp is not working reliable since upgrade to 4.1.0

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

JOEHIDALGO — Wed, 16 Nov 2011 15:04:41 GMT

Just out of curiosity do you guys have your PA's in VWire or L3?

I only ask because my setup is a little more complex where my edge FWs are Cisco ASA5550's and the PA's are a bump in the wire for our Internet connection.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

bG-rgb — Wed, 16 Nov 2011 15:06:22 GMT

We are running L3 interfaces only.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

Phillip_Dixon — Wed, 16 Nov 2011 15:11:56 GMT

I only run L3 interfaces.

I tried everything. Custom servics, specified FTP outbound ports, creating my own ftp custom application, no checking, no logging, disabling injection response.

I gave up in the end. After two days of messing about with different settings on the firewall i'd had enough.

If i tried using filezilla in passive/active mode it worked. If I tried using Internet explorer in passive mode it would allow me to logon but then the server disconncted and IE couldn't see anything, eventually returning an error. As soon as I switched IE to active mode it worked.

My reseller wanted me to leave it as it was so we could debug it with them but it was a pain in the backside for my company.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

cenders — Wed, 16 Nov 2011 16:43:24 GMT

I am having this problem as well, yet, filezilla also fails in addition trying IE.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

ERIKS — Tue, 22 Nov 2011 12:43:05 GMT

I am also seeing this issue with some internet based users trying to ftp to servers on our DMZ and using passive mode.

This is effecting business critical servers as we are using ftp for some of our EDI orders.

I would rather not have to down grade back to 4.0.7 as 4.1 fixes some other issues that we were having with VPN connections.

Can anyone from Paloalto Networks tell us how long are we likely to have to wait before we see a version 4.1.1 to fix this issue please?

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

surfright1 — Tue, 22 Nov 2011 13:01:36 GMT

For everyone having this issue: Palo Alto Networks is aware of the problem and we sent them a pcap network dump of our FTP traffic, along with a Tech Support File of our device.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

surfright1 — Tue, 06 Dec 2011 20:23:18 GMT

I just got word from Palo Alto Networks that they have fixed this issue by updating the application database to version 278-1187 (and higher). I also heard PAN-OS 4.1.1 is coming soon. Since there are some other critical issues with PAN-OS 4.1, my premium support advised me to wait for 4.1.1, which is coming within a week or 2.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

surfright1 — Tue, 07 Feb 2012 12:17:41 GMT

Update: Today I have updated my firewall to PAN OS version 4.1.2 and Applications and Threats to version 290-1273. FTP related fixes from the release notes of PAN OS 4.1.2:

35009 – Active FTP not working properly through the firewall due to App-ID queue counters not incrementing properly causing the connection to fail

34353 – Clients behind the firewall are not able to establish passive FTP connections to external servers due to a mismatch in the NAT pool IDs

One would guess it's fixed now after months, but no... *double face palm*

I am sending a support file to Palo Alto Networks again but if they can't fix this soon I want my thousands of euros back!!! This is getting really rediculous!

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

amitd — Fri, 24 Feb 2012 12:40:36 GMT

We're experiencing the same issue with all the latest versions (PAN OS and app database), is there any progress on this or at least a known work-around?

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

msoenetmgr — Tue, 17 Apr 2012 20:26:53 GMT

I'm running into this as well. I'd fixed it in the past with a policy work-around specific to the inbound passive FTP IP address, but since I upgraded to PAN-OS 4.1.4, it no longer works again. I'd love to see this bug fixed for good, instead of showing up again each time I update the OS. Any information on how to address this would be appreciated.

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

surfright1 — Wed, 18 Apr 2012 12:48:07 GMT

Yesterday, after months of trying and complaining, a technical support engineer from a local Palo Alto Networks distributor came to our office to once and for all investigate the problem with FTP. We upgraded our PA-500 appliance to PAN-OS 4.1.5 and, as always FTP was no longer working. So we started to compare the traffic using Wireshark captures from FTP traffic through PAN-OS 4.0.10 and PAN-OS 4.1.5.

After 20 minutes we stumbled upon a lead and the support engineer phoned official Palo Alto Networks support directly. For over an hour Palo Alto Networks worked with the local engineer to solve the problem and they found the bug! The exact phrase was "oh shit". So FTP is broken (like many said before) and it seems that it's caused by the prediction engine in the firewall.

The technical engineer from the local distributor wrote an application override for our ftp server. Palo Alto Networks is working on an update to solve the bug. So currently, PAN-OS 4.1.x and FTP is working for us now using the workaround!

Re: Problem with MLSD command on FTP after upgrade to 4.1.0

cenders — Wed, 18 Apr 2012 14:09:20 GMT

Wow, that sounds extremely frustrating. I'm happy my version of the problem was resolved back in November then they released an app definition update. Your persistance though in getting this resolved is a benefit to all of us. So thank you!