FTP session logged as 2 TCP sessions

[santonic]

Hello.

I have a problem with the way PA handles FTP sessions. I have a general rule which allows privileged user groups to have full access to a certain network. So application and service in this rule is 'any'. One of the applications users will be using is FTP.

When I look at traffic logs i see 2 TCP session for each use of FTP application. Let's say client is at 1.1.1.1 and FTP server at 2.2.2.2.

Every time a client starts FTP session i see 2 TCP sessions in logs:

- TCP session from 1.1.1.1:yyyy to 2.2.2.2:21

- followed by TCP session from 2.2.2.2:xxxx to 1.1.1.1:20

I know FTP application consists of 2 TCP session. But shouldn't PA as an application firewall match DATA session with CONTROL session and regard them as single use of FTP application?

This will be a big issue when the traffic from the mentioned network towards user segment will be set to 'deny'. I don't think having to open port 20 towards user segment is the way to go on application firewall.

Best regards,

Simon

[HULK]

Hello Simon,

Could you please confirm the session type in both directions:

For an example:

vsys1                                          199.167.52.5[4501]/Untrust-ISP  (199.167.52.5[4501])

63320        ssh            ACTIVE --------------- FLOW--------------------  ND   199.167.52.5[4030]/Untrust-ISP/6  (199.167.52.5[4030])  >>>>>>>>>>>>>>>>>>>>> this is a flow session.

I hope the TCP session from 2.2.2.2:xxxx to 1.1.1.1:20 is not a flow session, it's a PRED ( predict session). So, the firewall is expecting a connection from the server on that port. This is part of ALG ( application layer gateway) functionality.

Hope this helps.

[hshah]

Hi Santonic,

Kindly provide us output for "show session all filter source 1.1.1.1 destination 2.2.2.2:21". Make sure you have just started the FTP application.

As per issue, this output will generate two sessions. Then provide us output for "show session id <>" for both the sessions.

This will help us to determine root cause precisely.

Regards,

Hardik Shah

[santonic]

Thanx for the tip, i'll try to catch such session live.

Do predicted sessions go into traffic log as a seperate (TCP) session?

[HULK]

Hello santonic,

As per my understanding, predict session will be not logged under traffic logs. It will be only appear in the session table.

Thanks