I have a client that needs to download contractor instructions from the Texas DOT. Client says that he used to be able to download FTP documents but that the State says they performed some "upgrades" and now he can't download FTP documents. "We haven't had many complaints." --- TX DOT. It's a www site. Then you click the link and it attempts to download the file using FTP in your browser. Which means we're stuck using IE as the FTP client. If you'd like to try it for yourself go to: http://www.dot.state.tx.us/business/outline.htm Under Pre-Letting - Highways, click on Notice to Contractors Click on Official Notice for April 2007 Letting (this is the FTP download) Firewall client installed on workstation. FTP allow rule in place in ISA. Using or not using the FTP filter = no download. This message occurs in the browser on the workstation. ISA Server: extended error message : 200 Switching to Binary mode. 200 PORT command successful. Consider using PASV. 425 Failed to establish connection. In the ISA logs I have only an FTP Allowed connection to this server. No denied packets. In a Network Monitor session from my PC with Firewall Client installed I only see the HTTP Get command after that nothing. In a Network Monitor session from my server running ISA, I have these packets: 96 5.315429 192.168.16.27 192.168.16.4 HTTP HTTP: Request, GET ftp://ftp.dot.state.tx.us/pub/txdot-info/cmd/cserve/notice/apr07.txt 98 5.315429 172.25.25.2 141.198.136.6 DNS DNS: QueryId = 0x3F3C, QUERY (Standard query), Query for ftp.dot.state.tx.us of type Host Addr on class Internet 99 5.362304 141.198.136.6 172.25.25.2 DNS DNS: QueryId = 0x3F3C, QUERY (Standard query), Response - Success 100 5.362304 172.25.25.2 ns.dot.state.tx.us DNS DNS: QueryId = 0x3F3C, QUERY (Standard query), Query for ftp.dot.state.tx.us of type Host Addr on class Internet 101 5.424804 ns.dot.state.tx.us 172.25.25.2 DNS DNS: QueryId = 0x3F3C, QUERY (Standard query), Response - Success 102 5.424804 172.25.25.2 ftp.dot.state.tx.us TCP TCP: Flags=.S......, SrcPort=10581, DstPort=FTP control(21), Len=0, Seq=881058913, Ack=0, Win=65535 (scale factor 0) = 0 103 5.534179 192.168.16.4 192.168.16.27 TCP TCP: Flags=....A..., SrcPort=HTTP Alternate(8080), DstPort=1482, Len=0, Seq=1532377929, Ack=3696189552, Win=65282 (scale factor 0) = 0 106 5.471679 ftp.dot.state.tx.us 172.25.25.2 TCP TCP: Flags=.S..A..., SrcPort=FTP control(21), DstPort=10581, Len=0, Seq=3243607039, Ack=881058914, Win=5840 (scale factor 0) = 0 107 5.471679 172.25.25.2 ftp.dot.state.tx.us TCP TCP: Flags=....A..., SrcPort=10581, DstPort=FTP control(21), Len=0, Seq=881058914, Ack=3243607040, Win=65535 (scale factor 0) = 0 108 5.534179 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '220 "Welcome to TxDOT FTP service."' 109 5.534179 172.25.25.2 ftp.dot.state.tx.us FTP FTP: Request from Port 10581,'USER anonymous' 110 5.581054 ftp.dot.state.tx.us 172.25.25.2 TCP TCP: Flags=....A..., SrcPort=FTP control(21), DstPort=10581, Len=0, Seq=3243607077, Ack=881058930, Win=5840 (scale factor 0) = 0 111 5.581054 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '331 Please specify the password.' 112 5.581054 172.25.25.2 ftp.dot.state.tx.us FTP FTP: Request from Port 10581,'PASS IEUser@' 113 5.581054 24.231.162.80 172.25.25.2 SSL SSL 114 5.627929 24.231.162.80 172.25.25.2 SSL SSL 115 5.627929 172.25.25.2 24.231.162.80 TCP TCP: Flags=....A..., SrcPort=HTTPS(443), DstPort=53299, Len=0, Seq=3284276696, Ack=4236227266, Win=65404 (scale factor 0) = 0 116 5.627929 24.231.162.80 172.25.25.2 SSL SSL 117 5.627929 172.25.25.2 24.231.162.80 SSL SSL 118 5.627929 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '230 - License Agreement' 119 5.643554 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '230 - ' 120 5.643554 172.25.25.2 ftp.dot.state.tx.us TCP TCP: Flags=....A..., SrcPort=10581, DstPort=FTP control(21), Len=0, Seq=881058944, Ack=3243607186, Win=65389 (scale factor 0) = 0 121 5.706054 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '230 -' 122 5.706054 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581,'230 - damages, or costs, including reasonable attorney's fees, arising from the use of outdated files. ' 123 5.706054 172.25.25.2 ftp.dot.state.tx.us TCP TCP: Flags=....A..., SrcPort=10581, DstPort=FTP control(21), Len=0, Seq=881058944, Ack=3243608991, Win=65535 (scale factor 0) = 0 124 5.706054 172.25.25.2 ftp.dot.state.tx.us FTP FTP: Request from Port 10581,'CWD /pub/txdot-info/cmd/cserve/notice/apr07.txt' 125 5.752929 172.25.25.2 24.231.162.80 TCP TCP: Flags=....A..., SrcPort=HTTPS(443), DstPort=53299, Len=0, Seq=3284276696, Ack=4236227463, Win=65207 (scale factor 0) = 0 126 5.752929 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '550 Failed to change directory.' 127 5.752929 172.25.25.2 ftp.dot.state.tx.us FTP FTP: Request from Port 10581,'TYPE I' 128 5.815429 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '200 Switching to Binary mode.' 129 5.815429 172.25.25.2 ftp.dot.state.tx.us FTP FTP: Request from Port 10581,'PORT 172,25,25,2,41,86' 130 5.862304 ftp.dot.state.tx.us 172.25.25.2 FTP FTP: Response to Port 10581, '200 PORT command successful. Consider using PASV.' 131 5.862304 172.25.25.2 ftp.dot.state.tx.us FTP FTP: Request from Port 10581,'RETR /pub/txdot-info/cmd/cserve/notice/apr07.txt' The question at hand is, is this a problem with the way ISA is set up, or is the a problem with the FTP site? I have my thoughts but I would like yours. Thanks, Amy