SFTP privatekey file blocked by IPS since upgrade to 6.0

[icdata]

Hi,

I use a FortiGate 50E in our company and have IPS enabled. After the upgrade to 6.0, a script that uploads data via SFTP (WinSCP commandline) doesn't work anymore. The connection requires a private-keyfile (*.ppk), which is somehow blocked IPS. The keyfile doesn't reach the server for authentification.

I now deactivated IPS but that's not the solution I have in mind. Any ideas what I could do?

[neonbit]

You could add the IP address as an exception to the IPS policy. Firstly find the IPS signature that is causing this issue (should be easy to find in the IPS logs), then edit your IPS profile and add that signature as an exception, then add the IP address of the sending server as an IP exception.

[icdata]

Thanks. This was also in my mind. However, I am not able to identify the signature: My IPS log is completely empty. Either I missed a setting to turn on the log (I set the filter to "monitor" and enabled packet logging, but the log's still completely empty) or it's in fact not an IPS "hit" but the filter somehoew breaks the transmission of the key file... Any thoughts?

[icdata]

Bump - Any suggestions?

[walvis]

Any update on this, icdata? Having exactly the same issue at the moment.

[icdata]

Unfortunately not. Had to deactivate IPS due to lack of support on this issue from Fortigate.

[walvis]

Got some news from Support that should fix your issue:

The key rotation is a feature of the SSH inspection. There’s no way to turn it off but we can manually set this key permanently. Try to set the public key manually:

config firewall ssh host-key   edit "1"     set type RSA     set ip x.x.x.x     set hostname <server hostname>     set public-key "<public key in quotes>"   next end