Skip to main content
A
Anonymous_User
New Contributor III
September 11, 2007
Question

HTTP/HTTPS access through ssh tunnels

  • September 11, 2007
  • 2 replies
  • 7421 views
Hi, We were used to access the HTTP & HTTPS admin pages through SSH tunnels with MR3 & MR4 on our FortiGate 1000AFA2 and this not working on MR5 b564. The ssh client complains that " channel 1: open failed: administratively prohibited: open failed" This seems to be a ssh server issue. Does someone has noticed the same problem? Regards, Seb

    2 replies

    rwpatterson
    rwpatterson
    New Member
    September 11, 2007
    If the tunnel is in interface mode, make sure you enable the protocols on the sub-interface.
    A
    Anonymous_UserAuthor
    New Contributor III
    September 11, 2007
    The device is operating in bridge mode. No configuration change has been done between the previous firmware and the update. A roll back makes the tunnel work again perfectly ... Regards, Seb
    rwpatterson
    rwpatterson
    New Member
    September 11, 2007
    Fortinet may have rewritten the tunnel code between versions. I would put in a ticket. It may be a bug.
    Richard_Bartlett
    Richard_Bartlett
    New Member
    October 2, 2007
    I can confirm this occurs with the prohibited message. ssh connects to the firewall and the authentication occurs. Usually this will allow connection to the firewall and through it. With a FG200A that was working on 2.80 bld 489 the upgraded FortiOS3.0 bld 0483 fails with: ssh-client (OpenSSH Cygwin): channel 1: open failed: administratively prohibited: open failed Firewall ' diag debug app sshd' reports: SSH: server_input_channel_open: failure direct-tcpip This is different behaviour to earlier FortiOS. The SSH engine on the firewall also appears to look at the IP address that the connection ssh-client has been bound (that is coming up the tunnel) rather than the originating IP packet that is hitting the firewall. So with my ' 127.0.0.1 23' ssh port forward config I also had to enable 127.0.0.1 in the admin address list on the firewall to get the initial tunnel establishment to work. It is more secure this way but I' d rather not buy a dedicated OpenSSH platform to achieve this task if an older FortiOS from the same major release does in fact work. SSL VPNs could replace this but I don' t want the browser authentication for an enhanced SSL tunnel and certainly can' t use the limited terminal emulation in the Java telnet client supplied in-band by Fortinet.
    Terms & ConditionsAccessibility statement