Skip to main content
A
Anonymous_User
Contributor
April 12, 2007
Question

FTPS

  • April 12, 2007
  • 5 replies
  • 10926 views
I am setting up a FTP over SSL server for my company. I have everything setup and working internally. I have created profiles and the firewall policy for accessing the site externally but cannot get it working. If I turn off the SSL settings on my FTP server I can connect with no issues. I wondering if there is a port # that I have forgotten to forward or some odd setting in my 300A I am not aware of. Other info: I use SSL for my exchange server with no issues SSL/TLS port: 990 passive port: 60100-60200 ftp port: 21 (will change this once I get it working)

    5 replies

    doshbass
    doshbass
    New Member
    April 13, 2007
    I don' t have an answer here, but I would do a network trace without the FG to see what ports are being used just in case.
    A
    Anonymous_UserAuthor
    Contributor
    April 13, 2007
    Using CurrPorts (http://www.nirsoft.net/utils/cports.html) I can see that the server is using ports: 21 990 14147 (admin interface) 1086 (server interface) I have a remote FTP over SSL connection working to my home PC and it is using ports: 4806-4809 (these map to remote port 1977(my ftp port 21) and also seem to increment on remote server refreshes) 4902 (this maps to my passive ports 601xx, one of these is created for each transfer in effect) Im wondering where these 49xx ports are coming from and if I have to define them as well.
    doshbass
    doshbass
    New Member
    April 13, 2007
    This doc may help www.studentclearinghouse.org/ftps/pdfs/SecureFTP_FirewallGuide.pdf
    red_adair
    red_adair
    New Member
    April 13, 2007
    hhhmm - not sure if this really can work... FortiOS run several so called session-helper that parses different protocols that negotiate dynamic channels - like active-ftp would do for example. Where you have your control channel, and your data channel - the datachannel traffic (coming back) must be " opened" temporarily. same for many other protocols (you may check for session-helper in the docs) for ftps the communication is encrypted - hence a parser cannot determine on what port the protocols are negotiating. Is there something like " passive ftps" in case ? otherwise you may statically open the incoming data ports - which may be an issue in terms of security. most obvious we may not mix up SFTP and FTPS ;) i never used FTPS before - just zapping through the RFC ;) http://tools.ietf.org/html/rfc4217 Section 7 may be of interest . -R.
    A
    Anonymous_UserAuthor
    Contributor
    April 13, 2007
    Just so we are clear I am looking for FTPS not SFTP. I have ports (or so i believe) 21, 990 TCP/UDP open and forwarding to my server. Am I missing something?
    A
    Anonymous_UserAuthor
    Contributor
    April 20, 2007
    Hi, you must forward 60100-60200, too. As red.adair explained the FG cannot know that your FTP-Server told the client to connect to say port 60101 because the session-helper does not see the server' s response. I' d probably use a static mapping (full IP forward) for a FTP server. Also make sure to use Passive-FTP on the client side. Otherwise you' ll have to allow IIRC 989 -> Any outbound. Regards
    Terms & ConditionsAccessibility statement