防火墙ASPF（针对应用层包过滤技术） FTP（主动模式）

1.实验拓扑

2.基础配置

IP地址配置省略

[FW1-policy-security]di th
2025-05-29 12:20:13.740 
#
security-policy
 rule name trust->dmz
  source-zone trust
  destination-zone dmz
  source-address 10.1.11.0 mask 255.255.255.0
  destination-address 10.1.21.0 mask 255.255.255.0
  service ftp
  action permit
#

[FW1]dis zone 
2025-05-29 12:21:33.100 
#
trust
 priority is 85
 interface of the zone is (2):
    GigabitEthernet1/0/0
#
dmz
 priority is 50
 interface of the zone is (1):
    GigabitEthernet1/0/1
#

3.关闭ASPF

[FW1]undo firewall  detect ftp 

4.安全策略解决

[FW1-object-service-set-ftp_data]di th
2025-05-29 12:26:48.980 
#
ip service-set ftp_data type object 16
 service 0 protocol tcp source-port 20 destination-port 0 to 65535
#

[FW1-policy-security-rule-ftp_data]di th
2025-05-29 12:27:44.300 
#
 rule name ftp_data
  source-zone dmz
  destination-zone trust
  source-address 10.1.21.0 mask 255.255.255.0
  destination-address 10.1.11.0 mask 255.255.255.0
  service ftp_data
  action permit
#

这种方法不安全

[FW1-policy-security]rule name  ftp_data 
[FW1-policy-security-rule-ftp_data]disable 
 Warning: This command will invalidate the rule. Continue?[Y/N]y
Info: The policy is disabled successfully. 

禁用安全策略后

[FW1]firewall  detect ftp