topic About ftp passive mode App-ID insufficient-data in General Topics

About ftp passive mode App-ID insufficient-data

paloalto.netfos — Tue, 26 Mar 2013 04:41:44 GMT

Hi All,

We find that if ftp runs passive mode and go through paloalto fw, in the fw monitor -> logs -> traffic, we'll see the application should be identified as insufficient-data.

I also find that there are just few bytes for every logs in the Bytes column.

Anyone knows how to explain those results ?

Re: About ftp passive mode App-ID insufficient-data

UhMayYeah — Tue, 26 Mar 2013 04:54:44 GMT

Insufficient data means that there was not enough data to identify the application. So for example, if the 3-way TCP handshake completed and there was one data packet after the handshake but that one data packet was not enough to match any of our signatures, you would see insufficient data in the application field of the traffic log..

Ref:Incomplete, Insufficient data and Not-applicable in the application field

Re: About ftp passive mode App-ID insufficient-data

paloalto.netfos — Tue, 26 Mar 2013 06:10:34 GMT

Hi,

Thanks for feedbacks quickly. So if ftp runs passive mode and pass through paloalto fw, the fw could not identify it correctly as application "ftp", right? or not?

Regards,

Joy

Re: About ftp passive mode App-ID insufficient-data

UhMayYeah — Tue, 26 Mar 2013 07:16:00 GMT

Yes ,you would see insufficient-data, if the firewall does not see enough data packets to identify this traffic.

Do you see the traffic matching the expected security rule?

P.S: Application FTP would cover both Active+Passive variants.

-Ameya

Re: About ftp passive mode App-ID insufficient-data

ymiyashita — Tue, 26 Mar 2013 09:10:24 GMT

I agree with Ameya.

"few bytes for every log" also indicates that there's not enough data. Basically, even just to login to ftp server, the traffic size usually becomes a few hundred bytes. The first thing to check is to see whether ftp is really working.

- Yasu

Re: About ftp passive mode App-ID insufficient-data

paloalto.netfos — Fri, 29 Mar 2013 03:25:02 GMT

HI,

After upgrade content version 364-1728, the pa fw can correctly identified applicatin of ftp passive mode as "ftp" with high random ports.

My security policies setting as below.

Trust-zone, any source-addresses, to Untrust-zone, any destination-addresses, application eq ftp,service application-default, action eq allow.

Regards,