topic Re: how to make ssh work on different port number in General Topics

how to make ssh work on different port number

maple-palo — Wed, 14 Sep 2016 10:07:14 GMT

Hi,

my colleague requested for some server to communicate to outside server (internet) using sftp. but they want to use port 9122.

on the firewall rule i cannot find the way how to do it. i know sftp i using ssh port 22. i tried defining port 9122 and ssh as application but it doesnt work. anybody have any idea? tia

chris

Re: how to make ssh work on different port number

TranceforLife — Wed, 14 Sep 2016 10:30:20 GMT

Hi,

Did you try this?

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application-Override/ta-p/65513

So you need to have a custom application and override policy in place.

Cheers,

Myky

Re: how to make ssh work on different port number

Brandon_Wertz — Wed, 14 Sep 2016 12:43:07 GMT

When you specified the application SSH and specified the port tcp/9122 what did your deny logs say?

If Palo is seeing the traffic as SSH and it's in-fact communicating out via 9122 you shouldn't need to create a custom application.

Re: how to make ssh work on different port number

TranceforLife — Wed, 14 Sep 2016 13:36:19 GMT

Agreed. Sorry didnt read properly. Check logs, do PCAP if needed and add that port to the security policy service tab with SSH app

Re: how to make ssh work on different port number

maple-palo — Thu, 15 Sep 2016 02:06:19 GMT

hi guys, thanks for the reply. more info below. currently the setup is :

local server<-> palo alto vlan interface (dmz zone) <-> internet (public ip/26)<-> remote server

i have an NAT rule as below:

source ip = local server ip

source zone = dmz

dest zone = internet

destination address = any

destination interface = any

service = any

translation type = static

destination trasnlation = none

on the firewall rule i have :

source ip = local server

dest ip = remote server ip

source zone = dmz

dest zone = internet

application = any

service = specified as 9122

at this setup, if the server initiate sftp it doesnt even go thru the internet zone. if i filter the traffic in monitor i can see its going thru dmz then inside(another zone on the firewall) to our AD server. probably coz of dns. but if i set the firewall rule service to "any". it is working. so far i tried :

set application as ssh , service port as 9122 = doesnt work

created custom application with port 9122 but doesnt work. (but maybe my config is wrong)

Re: how to make ssh work on different port number

Brandon_Wertz — Thu, 15 Sep 2016 03:55:05 GMT

When you set the service to "any" what does the traffic log say the tcp port was?

Re: how to make ssh work on different port number

maple-palo — Thu, 15 Sep 2016 04:44:18 GMT

Hi Brandon,

the traffic log shows its using port 9122 and ssh is the application. which to me is correct since SFTP is an FTP using ssh on port 22:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Which-Application-to-Select-for-SFTP-When-Creating-a-Security/ta-p/55495

but on my setup we wanted to force sftp to work with 9122. but the system doesnt allow to modify ssh default port which is 22. this is what im tryng to find out whether there is a way to do it. thanks

Re: how to make ssh work on different port number

TranceforLife — Thu, 15 Sep 2016 07:28:10 GMT

Hi,

I am a bit confused now.

1) Are your servers running SFTP on the port 9122? So both listening on the port 9122.

2) In you NAT configuration. Do you want both sides to initiate a connection, if yes use the bi-directional option in the NAT and policy appropriate policy.

On the Palo if you specified SSH as app and port 9122 it should allow traffic on this port. If it does not work create a custom application with policy override. Just custom application wouldn't work

How about to do run PCAP on the firewall and, create a filter so you can see only communication between the servers.

Re: how to make ssh work on different port number

maple-palo — Thu, 15 Sep 2016 08:09:25 GMT

Hi tranceforlife, oh sorry if my details is confusing.

1. the machine on our side is the one initiating the SFTP. and we use telnet to test..telnet x.x.x.x 9122

2. as said the machine on our side is the one initiating the sftp, but by the way i already ticked the bidirctional option

sorry im quite new on this firewalling (esp palo alto) so im strugling doing this =(

Re: how to make ssh work on different port number

TranceforLife — Thu, 15 Sep 2016 09:48:37 GMT

Hi,

No worries. That is explained why it didnt work when you use ssh in app tab and port 9122. Because you actually used telnet app to test it. When you changed to any it did work. So l would suggest use putty or use actually ssh (you can change default port l belive in CLI on any system for test) to run actually ssh and test with custom port 9122.

Re: how to make ssh work on different port number

maple-palo — Thu, 15 Sep 2016 08:50:16 GMT

i just tried the custom application with policy override but no luck. i followed this one

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-Policy/ta-p/60044

Re: how to make ssh work on different port number

TranceforLife — Thu, 15 Sep 2016 13:51:31 GMT

Hi,

Could you please tell me what exactly didnt work?

1) Traffic was denied?

2) You didnt get reply from the server?

3) Traffic hitting wrong rule?

Can you talk to the server? I think the option would be to create any any to make sure you can actually talk to it (ping the server)

and after we will go futher

Re: how to make ssh work on different port number

maple-palo — Thu, 15 Sep 2016 09:35:09 GMT

sorry to confuse with my sentence. actually we are using both telnet and filzilla to test. everytime i did some change. but both doesnt work. if set to any any no problem both using telnet and filezilla to test.

Re: how to make ssh work on different port number

maple-palo — Thu, 15 Sep 2016 09:58:24 GMT

oh sweet **bleep**!!!its working now haha. the custom application works. its just that i didnt choose "application-default" on the service portion. after i changed it, tested working =)..so this link is working.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-Policy/ta-p/60044

thanks a lot for all who replied on this ! really really appreciate it. God bless u all

Re: how to make ssh work on different port number

reaper — Thu, 15 Sep 2016 12:02:36 GMT

so after taking out the service object for 9122 and replacing it with app-default it started working ?

if you look at the properties of the service object, does it look like this:

Re: how to make ssh work on different port number

maple-palo — Fri, 16 Sep 2016 01:43:20 GMT

Hi Reaper,

i exactly followed the procedure for the custom application. the application default im saying it at the firewall security rule. .i made it :

application field = the custom application i created with application override

service field = i chose application-default rather than the specific port 9122.

im not quite sure about the screenshot you shown. maybe im using different model mine is pa-4050

Re: how to make ssh work on different port number

reaper — Fri, 16 Sep 2016 21:16:47 GMT

the screenshot is of the service object

it should look identical on all platforms and across all PAN-OS versions, it can be found in Objects > services

if you click it's name you can look at the properties, to make sure it has not simply been named appropriately but tcp is set and the destination port is 9122 (and source port random)

Re: how to make ssh work on different port number

maple-palo — Mon, 19 Sep 2016 09:21:47 GMT

hi reaper, yes i also made a custom port wit h9122. but on the firewall rule i used "application-default" on the service field.

Re: how to make ssh work on different port number

reaper — Mon, 19 Sep 2016 09:57:55 GMT

I know, but since you needed to switch to application-default because the service object didn't work, i suspected the service object may have been misconfigured