FTP Files Problem

It smells like a cache somewhere giving a broken version file of putty.exe.. Not FTG because Filezilla use the same firewall policy and transfer ok. Verify checksum of putty.exe file to confirm the broken binary.

I' ve confirmed this problem with several different file with the same result as the example. Weird huh?

Sorry, I picked this up a bit late. I think you problem here may be caused by your use of the Windows FTP client not the FortiGate. By default, it starts in ASCII not Binary mode and will break any binary file transfer. Try the following: >ftp ftp.yoursite.com User: <username> Pass: ********* >bi >hash >get filename.exe This should result in a complete transfer. Let us know Carl

Same thing. If I ftp through the Unfiltered protection profile I get " Connection closed by remote host." after most of the file gets sent. If I run through a policy without any protection profile it goes fine.

Have you seen this apply if the FTP protocol is not even selected in the protection profile? Looking at the unfiltered profile I see that Interval is 10 and Amount is 1. I' ll try playing with those. Any recommendations? Thanks.

Selecting FTP under AV fixed it. I didnt want to apply the AV layer at the point this is deployed. So the questions are: 1) Why is this causing the file transfer to fail? 2) Why is it scanning AV if it' s not configured in the Protection Profile? 3) Would this apply to other protocols in AV?

yeah ... thats been my solution while troubleshooting this.

Dirk: I cannot completely address the anomalies of AV & IPS. We tried implementing them but found with our large site (20K computers) that the fortigates just couldn' t handle it. Being an educational institution to boot, the students tend to kick the tires much more then corporate or institutional clients. However, even with an av/ips free active profile list, the av & ips engines are running. They are what inspects the packets cached by the proxy service (thttp) and enforce the policies you have in place. You might want to check " diag sys top 1" and see how those services are running. If they are pegged the issue may be there. I have done some dos based ftp but not through the the fortigates. Just as a test, I used ftp to get putty from simon' s site & my files matched. I would suggest, if you have a support contract, that you open a call ticket. Victor P.S.: If you do implement AV, take the default file size of 10 and reduce it to 4 or lower on any of the protocols that you' ve activated. How many viruses/worms/trojans do you know that have sizes in the mb range?

Thanks Victor. Those processes are running fine. Max of 19 at any point in time. Just curious, in your environment what model Fortigate did you find incapable of handling those security layers? If not Fortinet what are you using?

We have two 3600s in HA (A-P). We had had them in A-A but stability was an issue and if you' ve had any experience doing a packet trace in that mode you' ve probably wished you were an Indian god (or should I say, goddess) and could' ve used those extra hands to handle all the putty sessions. As for how we handle without, we have other monitoring and IDS devices that monitor the flows at different stages in our networks. Fortinet has said that these 3600s should be able to handle our flows (between 125mbps to 140mbps during school hours) but it is not our experience when we add the additional services. Victor