Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ZiPPy
New Contributor

SFTP Issues

I' m having some trouble with getting SFTP to work on our Fortigate. Here is the policy I created: Source Interface/Zone: external Source Address: all Destination Address: SFTP_22_VIP * Schedule: always Service: SSH Action:accept *For the VIP(I named it SFTP_22_VIP). External Interface Static NAT External IP of our network 12.x.x.x Mapped IP Address: 192.168.x.x (our FTP server) Port Forwarding Service Port:22 Map to Port:22 Has anybody else had any troubles in creating an SFTP policy on their firewall?
6 REPLIES 6
ede_pfau
SuperUser
SuperUser

No, ssh VIP just works as expected. a) make sure you VIP port 22/tcp for ssh. b) not so sure about sftp - does it use port 22 as well? c) are you sure you don' t want to use ftps?
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
ZiPPy
New Contributor

That is correct, SFTP uses port 22 for SSH. From what I' ve read, FTPS is FTP that uses TSL/SSL to encrypt the control session and/or the data session. With FTPS the control session is always encrypted, but the data session might not be. Is this correct? My question is why would you choose one over the other? Maybe under specific circumstances of the data you' re sending? Let me try configuring it with FTPS and see how it goes.
ede_pfau
SuperUser
SuperUser

I just wanted to be sure you knew the difference and we talk about the same protcol. No preferences with either. - have you tried ' service=any' in the policy? Then you' ll have to resort to debug sniffing. Do you see packets coming through? Maybe the server doesn' t answer. Or do you even see server replies and they don' t make it through the FGT? - remember that the source address of the reply packets is the (private) IP address of your server UNLESS you check the NAT box in the policy.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
ZiPPy
New Contributor

So let me ask you in regards to sniffing, do you use Wireshark? I' ve dabbled with Wireshark a little, but let me fire that up and see what I see. Same result in using the ' service=any' Error: ssh_init: Host does not exist Could not connect to server
ede_pfau
SuperUser
SuperUser

Wireshark is an option but for FGT specific issues the built-in sniffer will do nicely:
 diag deb ena
 diag sniffer packet <interface> ' icmp or port 22'  6
You stop sniffing by hitting Ctrl-C. Try both ' internal' and ' wan1' for interface. Sometimes I use 2 ssh terminal sessions to sniff 2 interfaces at the same time. This should give you a clue what' s happening.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
ZiPPy
New Contributor

Oh very nice! I' ll definitely try this out. Thanks for the info mate!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors