Skip to main content
maziar_ravanbakhsh
maziar_ravanbakhsh
New Member
May 12, 2019
Question

How can I block FTP for uploading?

  • May 12, 2019
  • 2 replies
  • 6630 views

Hi,

 

Recently I have run a FortiGate firewall  between clents and servers. Now I want to publish FTP  in a Read-Only way for a specific subnet. How can I mange this with FortiGate. It is appreciated in advance if anybody shed a light on.

 

Best regards.

    2 replies

    Nicholas_Doropoulos
    Nicholas_Doropoulos
    New Member
    May 12, 2019

    Hi Maziar,

     

    Could you please clarify your request a little bit? Do you mean that you would like to block FTP uploads for a specific subnet? Or do you have an internal FTP server that you would like that subnet to be able to upload files to?

     

    Again, some more information would help a lot.

     

    Many thanks.

     

    sw2090
    SuperUser
    sw2090
    SuperUser
    May 13, 2019

    I don't think this is possible with any firewall since firewalls can only controll traffic from source to dest or vice versa.

    For functioning FTP you have to allow traffic in bothg direction.

    boneyard
    boneyard
    Valued Contributor
    May 13, 2019

    on itself an interesting request, though i don't believe this is possible with normal configuration. which is a little weird because the FortiGate should have the knowledge to make this decision. the application control feature can do this within certain cloud applications, so why not for something "simple" as FTP.

     

    i would say you have two options:

     

    1 - do something on the FTP server side. perhaps you can apply IP filters there in combination with commands.

     

    2 - do something with customer IPS signatures, which would block the PUT request. an example can be found here, but it isn't an easy solution: http://alstechcorner.blogspot.com/2013/10/how-to-block-anonymous-ftp-put-on.html

    Terms & ConditionsAccessibility statement