File transfer problems through VPN when Cisco IPS is enabled
- by Richard West
We have a Cisco ASA 5510 firewall with the IPS module installed.
We have a customer that we must connect to via VPN to their network to exchange files via FTP. We use the Cisco VPN client (version 5.0.01.0600) on our local workstations, which are behind the firewall and subject to the IPS.
The VPN client is successful in connecting to the remote site. However when we start the FTP file transfer we are able to upload only 150K to 200K of data, then everything stops. A minute later the VPN session is dropped.
I think I have isolated this to an IPS issue by temporarily disabling the Service Policy on the ASA for the IPS with the following command:
access-list IPS line 1 extended permit ip 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 inactive
After this command was issued I then established the VPN to the remote site and was successful in transferring the entire file.
While still connected to the VPN and FTP session I issued the command to enable the IPS:
access-list IPS line 1 extended permit ip 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
The file transfer was tried again and was once again successful so I closed the FTP session and reopened it, while keeping the same VPN session open. This file transfer was also successful. This told me that nothing with the FTP programs was being filtered or causing the problem. Furthermore, we use FTP to exchange files with many sites everyday without issue.
I then disconnected the original VPN session, which was established when the access-list was inactive, and reconnected the VPN session, now with the access-list active. After starting the FTP transfer the file stopped after 150K.
To me this seems like the IPS is blocking, or somehow interfering with the initial VPN setup to the remote site.
This only started happening last week after the latest IPS signature updates were applied (sig version 407.0). Our previous sig version was 95 days old becuase the system was not auto updating itself.
Any ideas on what could be causing this problem?
