topic Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory in VM-Series in the Public Cloud

FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

ebrookman — Thu, 17 May 2018 20:36:03 GMT

I have a "HA" pair of firewalls in Azure sitting behind an external Load Balancer. I have a FTP server that I have to configure behind the firewalls. I am able to connect locally to the FTP server and it works as expected, but when I point the FTP client to the Public IP address of the LB, I am able to connect, but not get the directory. I am using passive FTPS. I see the connection in the traffic table, and it has NAT applied and Allowed by the correct Security Rule. I am thinking it may be Azure causing the issue, but am unsure at this point.

Any suggestions would be greatly appreciated.

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

OtakarKlier — Fri, 18 May 2018 17:05:19 GMT

Hello,

Are the PAN's active/passive or active/active? If A/A, its proably asymetric routing back to the client.

Just a thought.

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

jmeurer — Fri, 18 May 2018 17:20:36 GMT

What is your NAT configuration? You should have both a Destination NAT of the FTP server and a Source NAT of the Trust side interface of the Firewall in the NAT policy. That will ensure proper return path.

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

glynn — Fri, 18 May 2018 18:10:46 GMT

Are you using FTP or FTPS? I see both mentioned in your post. Also, when you say you see the connection in the traffic table, do you see both the control and data channels or just the control?

One thing to look at is the distribution mode on the load balancer:

https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode

If you are using 'None' as the distribution mode, the load balancer will use src IP, src port, dst IP, dst port, and protocol to determine the backend pool member to use. If the control channel lands on one FW and the data channel on the other, the data channel will be dropped. Changing to one of the other distribution algorithms ("src IP" or "src IP and protocol") should ensure that both land on the same FW.

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

ebrookman — Mon, 21 May 2018 14:14:03 GMT

I am using FTPS, but also tested with FTP. I am using Src IP and Protocol for the transmission of the packets thorugh the load balancer. I have other services working as expected on the PAs. As far as traffic, I only see the control traffic in the monitor tab.

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

ebrookman — Mon, 21 May 2018 14:14:49 GMT

The firewalls are in an A/A setup, but Azure doesn't really do HA, so they don't syncronize the session information.

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

Steven Tan — Fri, 19 Nov 2021 04:07:28 GMT

Hi! Did you ever resolved this issue? I am facing the same problem and have not been able to find a solution. I have to add that my FTP works if I force the client into Active mode. I can then see the DATA traffic using TCP 20. However it does not work when using Passive mode which is required for FTPS. Appreciate any assistance here. Thank you in advance!!

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

ricd — Mon, 03 Oct 2022 12:56:40 GMT

Same, here, anyone solved this issue?

Re: FTP Server behind Palo Alto pair and Azure External Load Balancer Not getting directory

ricd — Mon, 03 Oct 2022 12:58:09 GMT

were you able to solve this?