file blocking profile not working for SFTP

[sumit_mame]

Hii

we are trying to access our internal storage using SFTP from internet. after applying file blocking profile we are able to access mentioned files but firewall not restrict the file. we found that file blocking is not happening.

Please advise how to block files when using SFTP.

[InfoSecPro]

Hi Sumit!

Having decription in place is a pre-requisite to being able to use the file blocking profile. Having decription configure is important because not having that means other security features are not working. Once you do that, it will detect the file and start working.

Inf0S3cPr0

[TomYoung]

Hi @sumit_mame and @InfoSecPro ,

SFTP is SSH File Transfer Protocol.  https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol  You can verify this by looking at the application identified by the NGFW.  It should be ssh.

While the NGFW can decrypt SSH, I believe it is only for the purpose of identifying the ssh-tunnel application.  So, I don't think SFTP can be identified or decrypted, which would be required to identify the file.  In addition, "SFTP is not FTP run over SSH" (URL above).  The protocol is different, and if the SSH session were decrypted, it would not be identified as ftp.

If the application is FTPS, then the NGFW will identify it as ssl.  Then you could decrypt it, and the NGFW should identify the traffic as FTP.  Then the file can be identified and blocked.

Thanks,

Tom

[sumit_mame]

Thanks tom for clarification.

Do you have any ideas for secure transfer of files that include file blocking?

[TomYoung]

Hi @sumit_mame ,

Does your server support FTP over SSL, or FTPS?  If so, use that and configure SSL Inbound Inspection on your NGFW.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-inbound-inspectio...

Second, please submit a feature request to your PANW SE to decrypt and decode SFTP.  I think a lot of customers would find that useful.

Thanks,

Tom