topic Re: FTPS and Service - problem in General Topics

FTPS and Service - problem

_slv_ — Wed, 02 Jul 2014 18:31:21 GMT

Hello

I have FTP server on Debian 7 (ProFTPD 1.3.1) and security rule:

and now FTPS connection works.

With "application-default" as a service FTPS sessions hangs on listing directory and sfter some time FTP client was disconected.

I'm on 6.0.2 PAN with latest updates.

Is this a normal behaviour? According to best practice we should use "application-default" as a service - but in this case we couldn't.

Please share Your opinion about that.

With regards

SLawek

Re: FTPS and Service - problem

hshah — Wed, 02 Jul 2014 18:35:11 GMT

Hi SLV,

Can you please put enalarged Traffic log, I think FTPS is using non-standard port here. That why "Any" is required.

Regards,

Hardik Shah

Re: FTPS and Service - problem

_slv_ — Wed, 02 Jul 2014 19:01:19 GMT

FTP server using standart ports.

Re: FTPS and Service - problem

hshah — Wed, 02 Jul 2014 19:03:30 GMT

Hi SLV,

Yes, FTP is using standard port 21 and it must work with application-default.

However, this discussion thread was opened for FTPS, which is different than FTP. Can you provide enlarged log for FTPS?

Regards,

Hardik Shah

Re: FTPS and Service - problem

_slv_ — Wed, 02 Jul 2014 19:05:31 GMT

What does mean "enlarged log for FTPS"?

Do You need "sh session id xxxx" output?

small update, I'm using 1.3.4a ProFTPD.

Regards

Slawek

Re: FTPS and Service - problem

hshah — Wed, 02 Jul 2014 19:06:51 GMT

Hi SLV,

If you read title for this thread it says "FTPS and service - Problem". Are you referring FTP by using word FTPS?

Regards,

Hardik Shah

Re: FTPS and Service - problem

hshah — Wed, 02 Jul 2014 19:23:38 GMT

Hello SLV,

If you want to find out root cause for issue, than try following commands.

debug dataplane packet-diag set filter on

debug dataplane packet-diag set filter match source <Client-IP> destination <Server-IP>

debug dataplane packet-diag set filter match destination<Client-IP> source <Server-IP>

show counter global filter packet-filter yes delta yes

Than Generate Traffic

Again execute command "show counter global filter packet-filter yes delta yes"

Regards,

Hardik Shah

Re: FTPS and Service - problem

AlexAState — Wed, 02 Jul 2014 19:48:42 GMT

you may want to look at the link below. FTPS is not a regular FTP

How to Allow FTPS/FTPES Traffic Through the Firewall

Re: FTPS and Service - problem

hshah — Wed, 02 Jul 2014 21:05:38 GMT

FTP uses 21 port

FTPS will use 443 port.

Applipedia doesn't have application name as FTPS.

Re: FTPS and Service - problem

pulukas — Thu, 03 Jul 2014 00:38:29 GMT

Look at your Ubuntu proftpd.conf file and confirm what port is configured as the listening port for the traffic. These are frequently on non-standard ports which mean you can't use application default. You can use any or the better option of the specific port that is configured.

Re: FTPS and Service - problem

_slv_ — Thu, 03 Jul 2014 06:18:40 GMT

Hello

Only one option related to ports is:

# Port 21 is the standard FTP port.

Port 21

FTPS uses the same port as a FTP (look onto my screenshot) and above configurations. Applipedia dosn't have dedicated app because its a regular FTP tunneled in SSL (according to my knoweladge)

With regards

Slawek

Re: FTPS and Service - problem

hshah — Thu, 03 Jul 2014 11:06:11 GMT

In that case FTPS is SSL running on port 25, hence you must need any for it to work.

Re: FTPS and Service - problem

MarcoLeckel — Thu, 03 Jul 2014 11:49:11 GMT

Hi ,

i think you are mixing up some thinks.

FTPS is FTP with TLS encryption and uses still standard Port 21

SFTP is secure copy over ssh Protocol which uses Port 22

I don't know why hshah is talking about Port 25

FTPS should work with app FTP and app-default (actually it does in my config)

You should start a flow debug to find out whats happening.

Regards

Marco

Re: FTPS and Service - problem

_slv_ — Thu, 03 Jul 2014 12:10:59 GMT

I have problem with FTPS I know what it is and differences between SFTP and FTPS http://en.wikipedia.org/wiki/FTPS

Regards

Slawek

Re: FTPS and Service - problem

MarcoLeckel — Thu, 03 Jul 2014 12:19:59 GMT

Ok,

FTPS (with client Option explicit over TLS) should work with app FTP and App default.

You should start a flow debug to find out whats happening.

Regards

Marco

Re: FTPS and Service - problem

_slv_ — Thu, 03 Jul 2014 12:44:29 GMT

Hi Marco

How to do flow debug? You mean pcap from PA device?

Regards

Slawek

Re: FTPS and Service - problem

AlexAState — Thu, 03 Jul 2014 13:04:08 GMT

FTP app will not work with FTPS. From SLVs description, they encrypt data and control channels. Encrypted control traffic doesn't allow PA to learn ports used for data connection. To make it work either decrypt SSL on the firewall or open all ports that are used for data channel

Re: FTPS and Service - problem

mivaldi — Tue, 08 Jul 2014 23:53:02 GMT

Just a shot in the dark here, but it could be that it works for you with 'any' and not with application-default on the service tab, because it interprets the application initially as ftp, and then changes to ssl on port 21, and selecting 'any' covers for that odd port for ssl.

Try adding a rule allowing application = ssl and ftp, then service tab=(create a service for TCP 21), check if this works.

Mariano.

Re: FTPS and Service - problem

_slv_ — Wed, 09 Jul 2014 06:46:04 GMT

I got response from Support,

"This issue has been addressed with latest content and threat release version, I was not able to reproduce the same issue with the new version(while I was able reproduce with threat-version: 443-2274)."

Regards

Slawek

Re: FTPS and Service - problem

pulukas — Wed, 09 Jul 2014 09:58:14 GMT

Thanks for sharing the issue and solution.