一.概述：
听了yeslab的秦珂老师的ASA视频，说PAT时，FTP服务器在Outside，FTP客户端在Inside，这种情况主动FTP能正常工作是因为:ftp审查可以使得穿越PAT时FTP能正常工作（修改了FTP应用层的数据），并且使得FTP主动模式下从Outside主动向Inside发起的包能够顺利通过防火墙。因为在路由器上配置PAT，FTP也能正常工作，因此打算测试一下，到底是FTP审查使得PAT能正常工作，还是ASA自身的PAT就能使得PAT能正常工作。
二.测试思路及结论：
A.关闭ASA的FTP审查，确认FTP被动模式是否能正常工作
----能正常工作，FTP被动模式都由Inside的FTP客户端主动发起，防火墙不需要放行策略的FTP审查就能正常工作
B.关闭ASA的FTP审查，Inside路由器作为FTP客户端设置为主动模式，确认FTP主动模式是否能正常工作
----不能正常工作，通过抓包可以发现，Outside接口FTP服务器收到的FTP客户端的发送的FTP应用层的数据中IP没有被更改，FTP服务器主动去连接PAT之前的地址，导致连接无法建立
----进一步确认了老师讲课所说的是正确的
三.测试拓扑：
四.基本配置：
A.FTP服务器
ip：202.100.1.1/24
开启3CDamon，并配置FTP服务器
B.ASA842防火墙：
①接口配置
interface GigabitEthernet0
nameif Outside
security-level 0
ip address 202.100.1.10 255.255.255.0
no shut
interface GigabitEthernet1
nameif Inside
security-level 100
ip address 10.1.1.10 255.255.255.0
nameif Outside
security-level 0
ip address 202.100.1.10 255.255.255.0
no shut
interface GigabitEthernet1
nameif Inside
security-level 100
ip address 10.1.1.10 255.255.255.0
no shut、
②全局policy map修改：
----关闭FTP审查，并且启用icmp审查
policy-map global_policy
class inspection_default
no inspect ftp
inspect icmp
③PAT配置：
object network Inside_net
subnet 10.1.1.0 255.255.255.0
nat (inside,outside) dynamic interface
C.Inside路由器：
①接口配置：
interface Ethernet0/0
ip address 10.1.1.1 255.255.255.0
no shut
②默认路由配置：
ip route 0.0.0.0 0.0.0.0 10.1.1.10
③FTP用户名和密码配置：
ip ftp username xll
ip ftp password 1234qwer,
ip ftp password 1234qwer,
五.测试步骤：
A.关闭FTP审查后，被动FTP能正常工作
①被动FTP能正常传文件
Inside#copy ftp: flash:
Address or name of remote host [202.100.1.1]?
Source filename [202.100.1.1]? xx.txt
Destination filename [xx.txt]?
%Warning:There is a file already existing with this name
Do you want to over write? [confirm]
Accessing ftp://202.100.1.1/xx.txt...
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased
Erase of flash: complete
Loading xx.txt
[OK - 24/4096 bytes]
Verifying checksum... OK (0x8A8A)
24 bytes copied in 6.820 secs (4 bytes/sec)
Inside#
Address or name of remote host [202.100.1.1]?
Source filename [202.100.1.1]? xx.txt
Destination filename [xx.txt]?
%Warning:There is a file already existing with this name
Do you want to over write? [confirm]
Accessing ftp://202.100.1.1/xx.txt...
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased
Erase of flash: complete
Loading xx.txt
[OK - 24/4096 bytes]
Verifying checksum... OK (0x8A8A)
24 bytes copied in 6.820 secs (4 bytes/sec)
Inside#
②Inside路由器接口抓包：
③Outside接口FTP服务器上面抓包：
B.关闭FTP审查后，主动FTP不能正常工作：
①Inside路由器设置FTP客户端为主动模式：
(config)#no ip ftp passive
②主动FTP无法正常工作：
Inside#copy ftp: flash:
Address or name of remote host [202.100.1.1]?
Source filename [202.100.1.1]? xx.txt
Destination filename [xx.txt]?
%Warning:There is a file already existing with this name
Do you want to over write? [confirm]
Accessing ftp://202.100.1.1/xx.txt...
Address or name of remote host [202.100.1.1]?
Source filename [202.100.1.1]? xx.txt
Destination filename [xx.txt]?
%Warning:There is a file already existing with this name
Do you want to over write? [confirm]
Accessing ftp://202.100.1.1/xx.txt...
③Inside路由器接口抓包：
④Outside的FTP服务器抓包：
---从抓包中，确实可以看到，如果不开启FTP审查的话，ASA不会修改FTP应用层的IP地址，因为FTP服务器收到FTP客户端告诉给它的地址为内网PAT前的地址，导致FTP服务器无法连接。
C.开启FTP审查后，被动FTP能正常工作：
①ASA防火墙开启FTP审查：
policy-map global_policy
class inspection_default
class inspection_default
inspect ftp
②被动FTP能正常工作：
Inside#copy ftp: flash:
Address or name of remote host []? 202.100.1.1
Source filename []? xx.txt
Destination filename [xx.txt]?
%Warning:There is a file already existing with this name
Do you want to over write? [confirm]
Accessing ftp://202.100.1.1/xx.txt...
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased
Erase of flash: complete
Loading xx.txt
[OK - 24/4096 bytes]
Verifying checksum... OK (0x8A8A)
24 bytes copied in 1.788 secs (13 bytes/sec)
Address or name of remote host []? 202.100.1.1
Source filename []? xx.txt
Destination filename [xx.txt]?
%Warning:There is a file already existing with this name
Do you want to over write? [confirm]
Accessing ftp://202.100.1.1/xx.txt...
Erase flash: before copying? [confirm]
Erasing the flash filesystem will remove all files! Continue? [confirm]
Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee ...erased
Erase of flash: complete
Loading xx.txt
[OK - 24/4096 bytes]
Verifying checksum... OK (0x8A8A)
24 bytes copied in 1.788 secs (13 bytes/sec)
③Inside路由器接口抓包：
④Outside的FTP服务器抓包：
----从抓包接口来看，确实因为开启FTP审查，ASA修改了FTP应用层的数据，将IP地址和端口进行了修改。
本文转自 碧云天 51CTO博客，原文链接：http://blog.51cto.com/333234/1304633，如需转载请自行联系原作者
