Routing for FTP Server

[#1]

Hi, I have FTP Server in my Organisation, I need FTP server to have Public IP as my vendors will directly FTP to the server and dump the files, also i need local LAN team to access that files, I have Router ethernet connecting to fortigate firewall 800 external interface and Internal Interface connecting to inside network Kindly let me know how do i achieve the same Thanks....Kiran

[#2]

even in that case, if i place the FTP server in the DMZ area only, i will disconnect from the internal LAN switch, still its not working, my problem is am not able to FTP with the Public IP address which is mapped in the fortigate (VIP), its not working,

[UkWizard]

do some packet sniffing from the command line, either from the status screen cli console, the serial port, or via ssh/telnet. do the following commands and then test the ftp; # diag sniff packet external ' port 21' look to see whether you see the incoming requests of packets. from the requesting clients IP address then do the same, but on the dmz port, like so (example presumes dmz port is called dmz, and not dmz1); # diag sniff packet dmz ' port 21' test and see whether you see packets being listed, if so, then the VIP is working but the FTP server must have issues. If the first test fails, then the ftp request isnt even hitting the fortinet in the first place. if the first works, but the second test doesnt show anything, there is something wrong somewhere on the fortinet, either a dodgy firmware build, a bug, or a config issue like network masks or routes/policy routes.

[#4]

Thanks, i will check the sniff results and let you know, below is the firmware details Firmware Version Fortigate-800 3.00-b0568(MR5 Patch 3) let me know does this version have any bug or anything ?

[rwpatterson]

All versions have some ' bugs' , but nothing that obvious that would stop the basic function of the device. A simple interface to interface policy works.

[UkWizard]

All versions have some ' bugs' , but nothing that obvious that would stop the basic function of the device. A simple interface to interface policy works.

Replace the word ' some' with ' many' on the above statement, wouldnt you say Bob? look at any release notes and their is usually a string of minor bugs, but nothing as serious to prevent this from working.

[rwpatterson]

" Some" , like " many" is a relative term. In millions of lines of code, " some" could be quite a number!

[#8]

Thanks Bob, now am able to connect to FTP server., reconfigured the policy and it worked, Cheersssss

[UkWizard]

oops - also if not previously asked, make sure you have a rule to allow the ftp server out. ie; Source Int: DMZ Source: FTP Server IP Dest: External Dest: all Services: any NAT: Enabled this isnt normally required, but in this case it might fix it, in which case, if it does, then change the services to only FTP, and test again.

[rwpatterson]

If the Lan hits the FGT and the FTP server hits the FGT, why can' t you get to the FTP from the LAN through the FGT? Check your basic setup. Something is wrong in there.

[#11]

I am trying to connect to FTP server from the outside my network, i.e. from my home, i am unable to connect to it, below is the build of Fortigate, Firmware Version Fortigate-800 3.00-b0568(MR5 Patch 3)