how to block ftp upload or download

Hi Kyle,

Did you have a look at these documents?:

https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/556943/ftp-proxy

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/537948/blocking-traffic-by-a-service-or-protocol

Regards,

Anthony

Hello ​@kyle-hsuan ,

Adding to ​@Anthony_E comment’s, You can also block specific file type using DLS,

A DLP file pattern can block, allow, log, or quarantine a file based on the specified file type in the file filter list (see Supported file types below).

https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/610893/supported-file-types

You can also use file filter as below to configure.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-a-file-based-on-a-pattern-using-DLP/ta-p/254726
 

Hi ​@kyle-hsuan ,

It is advisable to verify the port number on which the remote FTP service is listening. 

Please perform a packet capture directed at the destination FTP server's IP address to determine this information. 

On FortiGate CLI command : 

 
#diagnose sniffer packet any “host x.x.x.x​” 4 0 a

where x.x.x.x replace with FTP server ip address. 

Once the port number is identified, you can create a policy that specifies the destination server IP address and service port, and configure the action to deny access accordingly.

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
 

Thanks,
Mayur Padma