Skip to main content
younghwan_kim
New Member
April 19, 2018
Question

Stateful Inspection firewall with passive FTPS( Explicit FTPS ?).

  • April 19, 2018
  • 3 replies
  • 8825 views

I looking for a solution with Fortigate(FortiOS) to dynamically open the required FTPS-data port on Firtigate(firewall) with passive FTPS mode.  

 

Example,

1.When the client initiates a Control session(send Request:PASV), and get Response(with Data Port) from Server.

2.The firewall extracts the Data port number from the Response packet.

3.The firewall then records both the client and server's IP addresses and port numbers in an FTPS-data pending request list.

4.When the client later attempts to initiate a data connection, the firewall compares the connection request's parameters (ports and IP addresses) to the information in the FTPS-data pending request list, to determine whether the connection attempt is legitimate.

5.Since the FTPS-data pending request list is dynamic, the firewall can ensure that only the required FTP ports open.

6.When the session is closed, the firewall immediately closes the ports, guaranteeing the FTPS server's continued security.

 

My image is "explicit proxy for FTPS" about such as above feature. 

 

Is it possible with FortiOS?

 

Best Regards,

Kim 

    3 replies

    blackhole_route
    New Member
    April 20, 2018
    I’m interested in this as well. The only docs I’ve found indicate that there is no session helper (Alg) for ftps since ftps is encrypted and therefore the data port is not available to the FortiGate to open for the data traffic “pinhole”. http://kb.fortinet.com/kb....do?externalId=FD32835 From what I’ve read elsewhere, the above is true for ftps implicit mode ftps, but ftps explicit mode, passive - does leave control unencrypted at least to the extent that the data ports are able to be read on the wire. And I’ve found that other platforms do support ftpes, passive mode. For example, https://kb.juniper.net/In...content&id=KB19444 But I have not pcapped to confirm and put together a feature request just yet.
    younghwan_kim
    New Member
    April 21, 2018

    If we configure following workaround solution....

    http://kb.fortinet.com/kb....do?externalId=FD32835

     

    After then,Is there no way to control(Block) unsuspected FTPS-data request packet?

     

    For Example using 'tcp_flags' in Session keywords(Custom signature)? 

     

    Best Regards,

    Kim 

    ropeguru
    New Member
    April 21, 2018

    Never mind

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.