SFTP Issues

[ZiPPy]

I' m having some trouble with getting SFTP to work on our Fortigate. Here is the policy I created: Source Interface/Zone: external Source Address: all Destination Address: SFTP_22_VIP * Schedule: always Service: SSH Action:accept *For the VIP(I named it SFTP_22_VIP). External Interface Static NAT External IP of our network 12.x.x.x Mapped IP Address: 192.168.x.x (our FTP server) Port Forwarding Service Port:22 Map to Port:22 Has anybody else had any troubles in creating an SFTP policy on their firewall?

[ede_pfau]

No, ssh VIP just works as expected. a) make sure you VIP port 22/tcp for ssh. b) not so sure about sftp - does it use port 22 as well? c) are you sure you don' t want to use ftps?

[ZiPPy]

That is correct, SFTP uses port 22 for SSH. From what I' ve read, FTPS is FTP that uses TSL/SSL to encrypt the control session and/or the data session. With FTPS the control session is always encrypted, but the data session might not be. Is this correct? My question is why would you choose one over the other? Maybe under specific circumstances of the data you' re sending? Let me try configuring it with FTPS and see how it goes.

[ede_pfau]

I just wanted to be sure you knew the difference and we talk about the same protcol. No preferences with either. - have you tried ' service=any' in the policy? Then you' ll have to resort to debug sniffing. Do you see packets coming through? Maybe the server doesn' t answer. Or do you even see server replies and they don' t make it through the FGT? - remember that the source address of the reply packets is the (private) IP address of your server UNLESS you check the NAT box in the policy.

[ZiPPy]

So let me ask you in regards to sniffing, do you use Wireshark? I' ve dabbled with Wireshark a little, but let me fire that up and see what I see. Same result in using the ' service=any' Error: ssh_init: Host does not exist Could not connect to server

[ede_pfau]

Wireshark is an option but for FGT specific issues the built-in sniffer will do nicely:

 diag deb ena
 diag sniffer packet <interface> ' icmp or port 22'  6

You stop sniffing by hitting Ctrl-C. Try both ' internal' and ' wan1' for interface. Sometimes I use 2 ssh terminal sessions to sniff 2 interfaces at the same time. This should give you a clue what' s happening.

[ZiPPy]

Oh very nice! I' ll definitely try this out. Thanks for the info mate!