topic Re: How Passive FTP is filtered in Palo Alto in General Topics

How Passive FTP is filtered in Palo Alto

yadsingh — Sat, 14 May 2016 15:03:56 GMT

Hi Guys,

I know application FTP covers both Passive and Active FTP. However, my question is how it filters the traffic. I mean how a server Intiating a connection to the client will be filtered and allowed. Can anyone help.

Re: How Passive FTP is filtered in Palo Alto

BenjAudy.MTL — Sat, 14 May 2016 15:55:38 GMT

Hi,

The firewall create predict sessions. You can read about it here:

https://live.paloaltonetworks.com/t5/Learning-Articles/Palo-Alto-Networks-Firewall-Session-Overview/ta-p/55633

Benjamin

Re: How Passive FTP is filtered in Palo Alto

tsrivastav — Sun, 15 May 2016 05:16:53 GMT

#Firewall works on the concept of inspection.
#Connection request will be sent on port 21 , return packet will contain the DATA ports ( for example 3453 )

Firewall inspects this session and since it a past of a existing session,

#Firewall Opens a by-default pin hole for the data port ( as it already inspected the S2C packet ) and the traffic going on the data port are allowed.

Re: How Passive FTP is filtered in Palo Alto

tsrivastav — Sun, 15 May 2016 05:17:38 GMT

So if your question was how the firewall allows the traffic going on the data ports from Client to server

then Inspection of the FTP application is the answer

also predict session plays an imp. role in the same