How can I block FTP for uploading?

[maziar_ravanbakhsh]

Hi,

Recently I have run a FortiGate firewall  between clents and servers. Now I want to publish FTP  in a Read-Only way for a specific subnet. How can I mange this with FortiGate. It is appreciated in advance if anybody shed a light on.

Best regards.

[Nicholas_Doropoulos]

Hi Maziar,

Could you please clarify your request a little bit? Do you mean that you would like to block FTP uploads for a specific subnet? Or do you have an internal FTP server that you would like that subnet to be able to upload files to?

Again, some more information would help a lot.

Many thanks.

[sw2090]

I don't think this is possible with any firewall since firewalls can only controll traffic from source to dest or vice versa.

For functioning FTP you have to allow traffic in bothg direction.

[boneyard]

on itself an interesting request, though i don't believe this is possible with normal configuration. which is a little weird because the FortiGate should have the knowledge to make this decision. the application control feature can do this within certain cloud applications, so why not for something "simple" as FTP.

i would say you have two options:

1 - do something on the FTP server side. perhaps you can apply IP filters there in combination with commands.

2 - do something with customer IPS signatures, which would block the PUT request. an example can be found here, but it isn't an easy solution: http://alstechcorner.blogspot.com/2013/10/how-to-block-anonymous-ftp-put-on.html