FileZilla FTP Client fails through BlueCoat Proxy

Symptoms:

When using FileZilla FTP client through a bluecoat proxy, the FTP connection attempt fails with the below error message:

Status: Using proxy ftpproxy.mydomain.com

Status: Resolving address of ftpproxy.mydomain.com

Status: Connecting to 10.192.5.37:21...

Status: Connection established, waiting for welcome message...

Response: 220 Blue Coat FTP Service

Command: USER ftpuser@targetftpsite

Response: 331 Enter password.

Command: PASS ********

Response: 332 Enter proxy password.

Error: Login sequence fully executed yet not logged in. Aborting.

Error: Server might require an account. Try specifying an account using the Site Manager

Error: Critical error

Error: Could not connect to server

Versions:

• FileZilla FTP Client v3.5.2
• The LAN proxy server is a BlueCoat proxy server

Resolution/Workaround:

1. Go to FileZilla Client > Edit > Settings

2. In Connection > FTP > FTP Proxy

            2.1. Click on Custom and do the following:

            2.2. Under Custom, enter the following:

                                    USER %u@%h

                                    PASS %p

                                    ACCT %a

            2.3. Proxy host: <your_bluecoat_proxy_server>

3. Click OK.

Source:

http://forum.filezilla-project.org/viewtopic.php?p=19457#p19457

MPLS Label Distribution Parameters

MPLS Label Distribution Parameter Options:

Label Space Options	Per-Interface	Per-Plaform
Label Distribution	Unsolicited downstream	Downstream-on-Demand
Label Allocation	Independent Control Mode	Ordered Control Mode
Label Retention	Liberal Label Retention	Conservative Label Retention

---

Label Space Options

Per-Platform Labels

• LFIB: [Label | Action | Next Hop ]
• one label assigned to a destination network and announced to all neighbors
• locally unique, valid on all incoming interfaces
• smaller LFIB, FIB; faster label exchange
• less secure than per-interface labels; label-spoofing
• default in Frame-Mode MPLS

Per-Interface Labels

• LFIB:[IN intf | IN Label | NH intf | NH Label]
• one label for each destination, each device, each interface
• secure; prevents label-spoofing; labeled packets/ATM cells only accepted from interface where label is assigned
• default in Cell-Mode MPLS

---

Label Distribution

Unsolicited Downstream

• label advertised to all neighbor LSRs, regardless of whether upstream or downstream
• Frame-Mode

Downstream-On-Demand

• label advertised only upon request of upstream LSR
• cell-mode

---

Label Allocation 

Independent Control

• LSR can assign a label for a prefix w/o outgoing/downstream label
• for edge LSRs only (requires L3 capabilities)
• faster label propagation
• for unsolicited downstream / frame-mode

Ordered Control

• local label allocated and propagated only
• if exist(nexthop label) propagae/allocate label, else request label from nexthop
• for downstream-on-demand/cell-mode

---

Label Retention

Liberal Label Retention

• all received label stored in LIB, even if not from next-hop LSR
• improves convergence speed; allows easy failover for link failures
• frame-mode

Conservative Label Retention

• only received labels from nexthop LSRs are  stored; others are ignored
• downstream-on-demand/cell-mode

---

Standard Parameter Sets for Cisco Platforms

Parameter	Routers, frame interfaces	Routers, ATM interfaces	ATM switches
Label Space	per-platform	per-interface	per-interface
Label Distribution	unsolicited downstream	downstream-on-demand	downstream-on-demand
Label Allocation	independent control	independent control	ordered control
Label Retention	liberal label retention	conservative OR liberal	conservative

BGP Route Dampening

At a Glance: designed to reduce router processing load caused by unstable routes; prevents sustained routing oscillations without affecting well-behaved routes; RFC 2439: BGP Route Flap Dampening; minimizes BGP updates by suppressing unstable routes.

Route-Dampening Operation:

• EBGP route flaps = 1000 penalty points
• IBGP route flaps not dampened;
• penalty not user-configurable;
• penalty decays via exponential decay algorithm
• if penalty > suppress limit, route is dampened
• if penalty < reuse limit, dampened route is propagated
• if penalty < 1/2 reuse limit, flap history forgotten
• route is never dampened more than the maximum suppress time limit
• unreachable route with flap history is in history state (still in BGP table to retain flap history)
• penalty is applied to an individual path, not the prefix

---

Configuring Route Dampening:

router(config-router)# bgp dampening [half-life reuse suppress max-suppress-time] [route-map route-map-name]
half-life	time for penalty to halve (default 15 minutes)
reuse	penalty points when dampened route is reused (default 750)
suppress	penalty points when route is suppressed (default 2000)
max-suppress-time	maximum time a route is suppressed (default 1hour; maximum 255 minutes)

router(config-route-map)# set dampening half-life reuse suppress max-suppress-time

- used for less aggressive dampening of routes towards root DNS servers - dampening of smaller prefixes more aggressively - selective dampening based on BGP neighbors and route-map match criteria

Other Commands:

clear ip bgp ip_addr flap-statistics [{regexp regexp} | {filter-list listname} | {ipaddr mask} ]

clear ip bgp dampening [ipaddr mask]

show ip bgp dampened-paths

show ip bgp flap-statistics [{regexp regexp}|{filter-list listname}|{ipaddr mask [longer-prefix]}]

debug ip bgp dampening

BGP: Regular Expressions for AS-PATH Filtering

Symbol	Description
|	logical OR
.	match any
[x..y]	match one in range
^	match beginning of string
$	match end of string
_	match any delimiter/white space
( )	group as a single atom
*	match 0 or more instances of previous atom
?	match 0 or 1 instance of previous atom
+	match 1 or more instances of previous atom
\	escape character; if followed by a number n, points to the nth atom

Example 1: Advertise routes with empty AS-PATH (internal routes)

router bgp 123  neighbor 5.6.7.8 remote-as 387  neighbor 5.6.7.8 filter-list 1 out ! ip as-path access-list 1 permit ^$ !match "blank" atom at the "start" and "end" of string !

Example 2: Accept only default routes, preferring primary route based on AS PATH:

	AS387 (primary ISP)
	/
AS123
	\
	AS462 (backup ISP)

router bgp 123  neighbor 1.2.3.4 remote-as 462  neighbor 1.2.3.4 route-map FILTER in  neighbor 5.6.7.8 remote-as 387  neighbor 5.6.7.8 route-map FILTER in ! route-map FILTER permit 10 ! default routes from primary ISP (AS 387) accepted are preferred (larger weight)  match ip prefix-list DEFAULT_ONLY  match as-path 10  set weight 150 ! route-map FILTER permit 20 ! default routes from backup ISP are accepted, with lower preference than primary ISP routes  match ip prefix-list DEFAULT_ONLY  set weight 100 ! ip as-path access-list 10 permit _387$ ip prefix-list DEFAULT_ONLY seq 10 permit 0.0.0.0/0 !

Example 3: AS PATH Filtering with AS Path Prepending:

- customer in AS123 is performing AS-PATH pre-pending

AS123
10.0.0.1	\
	\
	AS462

router bgp 387  neighbor 10.0.0.1 remote-as 213  neighbor 10.0.0.1 filter-list 10 in ! ip as-path access-list 10 permit ^123(_123)*$ ! accepts "123", "123 123", or "123 123 123"

Example 4: AS PATH Filtering with AS Path Prepending, multiple customers:

- multiple customers performing AS PATH Prepending

Customer 1
	\
Customer 2 -	AS387
	/
Customer 3

!

router bgp 387  neighbor 10.0.0.1 remote-as 123  neighbor 10.0.0.1 filter-list 10 in  neighbor 20.0.0.1 remote-as 456  neighbor 20.0.0.1 filter-list 10 in  neighbor 30.0.0.1 remote-as 789  neighbor 30.0.0.1 filter-list 10 in ! ip as-path access-list 10 permit ^([0..9]+)(_\1)*$ ! accepts repeating instances of "123", "456", and "789" ! does not accept strings non-repeating strings (e.g. "123 123 100") !

Notes:
atom 1 = at least one instance of a number at the beginning of the string;
atom 2 = 0 or more instances of a whitespace and atom 1 until the end of the string.