topic Re: Security policy rule - allowing a specific host access to ftp.sophos.com in General Topics

Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Tue, 04 Dec 2018 11:12:52 GMT

Hello,

A colleague needs to access ftp.sophos.com (195.171.192.29) using Filezilla as their SFTP client, via TCP port 990. I set up the security policy rule as follows:

They could not log onto the ftp.sophos.com site. The password credentials they used are correct. Is the rule set up correctly? On a Cisco ASA I would have used the following ACL:

access-list aclinside extended permit tcp any host 195.171.192.29 eq 990

Any advice is much appreciated.

Regards,

Roberto

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Hodor — Tue, 04 Dec 2018 13:27:15 GMT

Hi, as i can see at the last image you're using Profile Groups (in your case SPG_Outband). Have you also checked, that the "File Blocking Profile" for this group is set allowed / in alert mode? It may be that everything is blocked here.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

DPoppleton — Tue, 04 Dec 2018 13:39:50 GMT

I've had to add the SSH application to many SFTP rules, as the firewall usually sees that. Look in your Unified Logs and it should show you why it was denied.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Tue, 04 Dec 2018 13:56:43 GMT

Hello Hodor,

Thanks for your reply. The file blocking profile looks good.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Brandon_Wertz — Tue, 04 Dec 2018 14:21:32 GMT

Like @DPoppleton mentioned what do the deny logs say is the reason for traffic being stopped? What is the FW seeing?

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Tue, 04 Dec 2018 14:49:52 GMT

Hi DPoppleton,

I don't see any 'deny' in the Actions when the user is trying to access 195.171.192.29

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

DPoppleton — Tue, 04 Dec 2018 14:57:30 GMT

That screen shot shows the application as FTP, which means the FileZilla client isn't encrypting. The client may need to be set to use SFTP (and the firewall will see that as SSH, so you will need to add that application to your rule.)

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Wed, 05 Dec 2018 11:08:58 GMT

Hi DPoppleton,

Thanks for your reply again. I have now added SSH under Application within my rule.

I will have the user test.

Many thanks,

Roberto

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Wed, 05 Dec 2018 11:12:45 GMT

@DPoppleton, forgot to mention that the Filezilla client was configured for SFTP and was tested on a ADSL line and the user was able to connect fine.

Thanks,

Roberto

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

DPoppleton — Fri, 07 Dec 2018 14:24:13 GMT

Have you found a solution to this issue yet?

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Tue, 11 Dec 2018 11:57:20 GMT

Hi DPoppleton,

Still not working.

I get this from the log in the Filezila FTP client.

Filezila client configured as so for FTP over SSL/TLS

Logs from Unified today.

Any further advice will be appreciated.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

DPoppleton — Thu, 13 Dec 2018 21:22:46 GMT

This isn't caused by the firewall.... I seem to remember a problem with the MLSD command with certain clients or servers while running a passive FTP connection. Try it as an active connection and I think it would work.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

soujanyabargavi — Sun, 16 Dec 2018 15:35:48 GMT

Thanks for the info on allowing a specific host access to ftp.sophos.com jira

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Rikkert_Kooy — Mon, 17 Dec 2018 13:32:34 GMT

Very important this is NOT sftp (which is a file transfer protocol using the same port and encryption as ssh). We are talking about ftp over ssl.

this is explicit ftp over ssl. Meaning the client wil use ftp to connect to ftp.sophos.com and than do TLS encryption and than with an encrypted connection it will do authentication and negotation which ports to use for the data connection.

fom https://community.sophos.com/kb/en-us/113454

you will need to allow the application: ftp to connect to tcp port 990 for ftp.sophos.com.

after that you will need to allow the application ssl with ports 50000-51000

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Thu, 20 Dec 2018 12:03:50 GMT

Hi Rikkert_Kooy,

Thank you for your reply. My mistake, it is explicit FTP over SSL, not SFTP.

I have added ftp to the Application and already had TCP port 990 under the Service. I also added SSL and the port range 50000-51000, but it is still not working. The Palo is not configured for SSL decrypt/encrypt. Could this be why it is still not working?

Unified logs - it says incomplete in Application. What does this mean please?

Error message on the Filezilla client

Thanks.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Thu, 20 Dec 2018 12:17:09 GMT

Hi DPoppleton,

I set the Transfer Settings to Active in the FTP client (I guess this what you meant), but still not working. I did what Rikkert_Kooy suggested too and still no joy. Is it because the Palo is not configured with SSL decrypt/encrypt?

Thanks.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Rikkert_Kooy — Thu, 20 Dec 2018 14:27:42 GMT

Hi rchung54,

decrypting ssl traffic is not strictly needed to make this connection possible. I have configured passive ftp with explicit ssl in this way before.

I see that your rule is being hit for the passive connection on port 50661 (your filezilla screenshot shows that the client is trying to connect to 195.171.192.29:50661 (197*156+227)), but your ftp client either says the connection has timed out or that the server denied the connection (were the three error messages at the same time?).

What does your Palo alto say is the reason for the session end reason?

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

rchung54 — Thu, 20 Dec 2018 14:40:20 GMT

Hi Rikkert_Kooy,

Yes, i saw the three error messages at the same time on the Filezilla client.

The Session End Reason is 'tcp-rst-from-server'.

What does it mean where it says 'incomplete' under Application please?

Thanks.

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Rikkert_Kooy — Thu, 20 Dec 2018 15:40:30 GMT

incomplete means not enough packets have gone through the Palo Alto for it to recognise the application. So it doesn't know yet whether it is SSL (which the rule allows) or something else.

If I read the session end reason it seems like the ftp.sophos.com causes the disconnect, but likely because the client was trying to connect to it for 20 seconds.

Why your FTP client wasn't able to actually connect to the server in passive mode I do not understand.