Skip to main content
ZiPPy
ZiPPy
New Member
June 22, 2011
Question

SFTP Issues

  • June 22, 2011
  • 6 replies
  • 11017 views
I' m having some trouble with getting SFTP to work on our Fortigate. Here is the policy I created: Source Interface/Zone: external Source Address: all Destination Address: SFTP_22_VIP * Schedule: always Service: SSH Action:accept *For the VIP(I named it SFTP_22_VIP). External Interface Static NAT External IP of our network 12.x.x.x Mapped IP Address: 192.168.x.x (our FTP server) Port Forwarding Service Port:22 Map to Port:22 Has anybody else had any troubles in creating an SFTP policy on their firewall?

    6 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    June 22, 2011
    No, ssh VIP just works as expected. a) make sure you VIP port 22/tcp for ssh. b) not so sure about sftp - does it use port 22 as well? c) are you sure you don' t want to use ftps?
    ZiPPy
    ZiPPyAuthor
    New Member
    June 22, 2011
    That is correct, SFTP uses port 22 for SSH. From what I' ve read, FTPS is FTP that uses TSL/SSL to encrypt the control session and/or the data session. With FTPS the control session is always encrypted, but the data session might not be. Is this correct? My question is why would you choose one over the other? Maybe under specific circumstances of the data you' re sending? Let me try configuring it with FTPS and see how it goes.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    June 22, 2011
    I just wanted to be sure you knew the difference and we talk about the same protcol. No preferences with either. - have you tried ' service=any' in the policy? Then you' ll have to resort to debug sniffing. Do you see packets coming through? Maybe the server doesn' t answer. Or do you even see server replies and they don' t make it through the FGT? - remember that the source address of the reply packets is the (private) IP address of your server UNLESS you check the NAT box in the policy.
    ZiPPy
    ZiPPyAuthor
    New Member
    June 22, 2011
    So let me ask you in regards to sniffing, do you use Wireshark? I' ve dabbled with Wireshark a little, but let me fire that up and see what I see. Same result in using the ' service=any' Error: ssh_init: Host does not exist Could not connect to server
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    June 23, 2011
    Wireshark is an option but for FGT specific issues the built-in sniffer will do nicely:
     diag deb ena  diag sniffer packet <interface> ' icmp or port 22'  6
    You stop sniffing by hitting Ctrl-C. Try both ' internal' and ' wan1' for interface. Sometimes I use 2 ssh terminal sessions to sniff 2 interfaces at the same time. This should give you a clue what' s happening.
    ZiPPy
    ZiPPyAuthor
    New Member
    June 23, 2011
    Oh very nice! I' ll definitely try this out. Thanks for the info mate!
    Terms & ConditionsAccessibility statement