Re: ISA Server Error 421

Hello,

The problem occurs because the target FTP server is failing to handle a
request
from the ISA server to retrieve a file, and is terminating the connection
with a
fatal error. The problem does not occur when ISA is not involved because a
direct
FTP client connection makes the request in a different, though equally
correct,
way. The primary difference is that ISA precedes the RETR command with a
CWD
against the filename. Apparently, the FTP server improperly handles this
and
abruptly ends to connection.

FTP is defined in RFC 959 (ftp://ftp.isi.edu/in-notes/rfc959.txt). The FTP
RFC
defines two verbs which are relevant to the issue you're currently
experiencing.
First, the CWD action which instructs the FTP server to change the current
working
directory to another directory. CWD is used to navigate through the
directory tree
hosted on the FTP server:

CHANGE WORKING DIRECTORY (CWD)

This command allows the user to work with a different
directory or dataset for file storage or retrieval without
altering his login or accounting information. Transfer
parameters are similarly unchanged. The argument is a
pathname specifying a directory or other system dependent
file group designator.


Second, the RETR verb instructs the FTP server to send the file requested
back to
the requesting client:

RETRIEVE (RETR)

This command causes the server-DTP to transfer a copy of the
file, specified in the pathname, to the server- or user-DTP
at the other end of the data connection. The status and
contents of the file at the server site shall be unaffected.


In a situation where the FTP client is not passing through ISA, the FTP
conversation looks like the following:

1. FTP client makes connection to server
2. server prompts for logon, client authenticates
3. client requests file by issuing RETR for the file name
4. server responds by sending the requested filename

In the scenario where ISA involved, the basic structure is the same, except
that
ISA, rather than initially sending a RETR for the filename, instead sends a
CWD for
it. ISA does this because it is acting as a proxy on the client's behalf
and
doesn't initially know whether the data requested by the client is a
directory or a
file. As such, ISA sends a CWD to attempt to change to a directory; if the
target
is not a directory, the FTP server should respond back saying that the
requested
directory name is invalid. At that point, ISA will realize that the
requested
target is an actual file and will issue a RETR to download it. So, the
conversation with ISA looks like the following:

1. client sends request to make connection to ISA, which then makes a
connection on
its behalf to the FTP server
2. server prompts for logon, ISA prompts client and returns credentials to
the FTP
server
3. client requests data, ISA proxies this request by making a CWD to the FTP
server
for the data requested
4. if the data requested is a file, the FTP server should respond with a
550,
requested directory is invalid
5. after seeing the 550, ISA knows the data is a file and requests it again
with a
RETR
6. FTP server sends the file to ISA, which then sends it to the client

In this case, the FTP server breaks down in step 6 where it fails to begin
sending
the file, instead terminating with:

FTP: Resp. to Port 8971, '421 Server error. (Trapped unexpected
WarFileExcep'

To remedy the situation, contact the FTP server administrator and
determining if
any updates exist for the FTP server software. The data on the FTP server
could
also be shared out over HTTP, allowing you to bypass the problem with the
FTP server by using a different protocol.


Regards,

Henk

"Michele" <Michele@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BEDCABEF-AF68-43EF-B388-F3F9940C3E38@xxxxxxxxxxxxxxxx
When users try to open a PDF on an FTP site they get the following error:
200 Type set to I.
200 PORT command successful
421 Server Error. (Trapped unexpected WarFileException). Connection
closed.




.

Relevant Pages

  • Re: Is this a 3-Leg Perimeter scenario?
    ... We have a Linux based firewall (SmoothWall) supporting a Linux based FTP server. ... that you could make it work by giving ISA help as to what to do indicates that the smoothwall is incorrectly configured. ... With your current network layout, internal clients should be able to reach the FTP server using either the internal IP of the Smoothwall, or its' public IP since ISA knows how to reach that. ... It also had the same error with the Internet Connection NIC in the description. ...
    (microsoft.public.windows.server.sbs)
  • Re: FTP Attacks
    ... ISA to get to the FTP server. ... But I guess the FTP server would have to ... communicate with ISA that it was a failed login. ... You also can't "lock out" an account that doesn't exist. ...
    (microsoft.public.isa)
  • Re: FTP download failed via ISA E.E 2006 when FTP site requires lo
    ... upstream FTP server. ... If ISA responds "The login request was denied", ... you are connecting to that FTP server using a CERN proxy request (handled ... logon the FTP server is NOT the same as that used to authenticate against ...
    (microsoft.public.isa)
  • ISA 2004 and Passive FTP from clients
    ... Since yesterday we are running ISA 2004 instead of ISA 2000. ... - Clients using a program that works with passive FTP have the Firewall ... all returning packets from the FTP server by the default-block rule.... ...
    (microsoft.public.isa)
  • 426 Connection closed; transfer aborted (MSFTPSVC behind ISA)
    ... Have problems with connection to FTP server behind an ISA ... server in passive mode. ...
    (microsoft.public.inetserver.iis.ftp)