how to make ssh work on different port number

[maple-palo]

Hi,

my colleague requested for some server to communicate to outside server (internet) using sftp. but they want to use port 9122.

on the firewall rule i cannot find the way how to do it. i know sftp i using ssh port 22. i tried defining port 9122 and ssh as application but it doesnt work. anybody have any idea? tia

chris

[TranceforLife · Accepted solution]

Hi,

Did you try this?

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-How-to-Create-an-Application-...

So you need to have a custom application and override policy in place.

Cheers,

Myky

[Brandon_Wertz]

When you specified the application SSH and specified the port tcp/9122 what did your deny logs say?

If Palo is seeing the traffic as SSH and it's in-fact communicating out via 9122 you shouldn't need to create a custom application.

[TranceforLife]

Agreed. Sorry didnt read properly. Check logs, do PCAP if needed and add that port to the security policy service tab with SSH app

[maple-palo]

hi guys, thanks for the reply. more info below. currently the setup is :

local server<-> palo alto vlan interface (dmz zone) <-> internet (public ip/26)<-> remote server

i have an NAT rule as below:

source ip = local server ip

source zone = dmz

dest zone = internet

destination address = any

destination interface = any

service = any

translation type = static

destination trasnlation = none

on the firewall rule i have :

source ip = local server

dest ip = remote server ip

source zone = dmz

dest zone = internet

application = any

service = specified as 9122

  at this setup, if the server initiate sftp it doesnt even go thru the internet zone. if i filter the traffic in monitor i can see its going thru dmz then inside(another zone on the firewall) to our AD server. probably coz of dns. but if i set the firewall rule service to "any". it is working.  so far i tried :

set application as ssh , service port as 9122 = doesnt work

created custom application with port 9122 but doesnt work. (but maybe my config is wrong)

[Brandon_Wertz]

When you set the service to "any" what does the traffic log say the tcp port was?

[maple-palo]

Hi Brandon,

the traffic log shows its using port 9122 and ssh is the application. which to me is correct since SFTP is an FTP using ssh on port 22:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Which-Application-to-Select-for-SFTP-Whe...

but on my setup we wanted to force sftp to work with 9122. but the system doesnt allow to modify ssh default port which is 22. this is what im tryng to find out whether there is a way to do it. thanks

[TranceforLife]

Hi,

I am a bit confused now.

1) Are your servers running SFTP on the port 9122? So both listening on the port 9122.

2) In you NAT configuration. Do you want both sides to initiate a connection, if yes use the bi-directional option in the NAT and policy appropriate policy.

On the Palo if you specified SSH as app and port 9122 it should allow traffic on this port. If it does not work create a custom application with policy override. Just custom application wouldn't work

How about to do run PCAP on the firewall and, create a filter so you can see only communication between the servers.

[maple-palo]

Hi tranceforlife, oh sorry if my details is confusing.

1. the machine on our side is the one initiating the SFTP. and we use telnet to test..telnet x.x.x.x 9122

2. as said the machine on our side is the one initiating the sftp, but by the way i already ticked the bidirctional option

sorry im quite new on this firewalling (esp palo alto) so im strugling doing this =(

[TranceforLife]

Hi,

No worries. That is explained why it didnt work when you use ssh in app tab and port 9122. Because you actually used telnet app to test it. When you changed to any it did work. So l would suggest use putty or use actually ssh (you can change default port l belive in CLI  on any system for test) to run actually ssh and test with custom port 9122.

[maple-palo]

i just tried the custom application with policy override but no luck. i followed this one

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-Po...

[TranceforLife]

Hi,

Could you please tell me what exactly didnt work?

1) Traffic was denied?

2) You didnt get reply from the server?

3) Traffic hitting wrong rule?

Can you talk to the server? I think the option would be to create any any to make sure you can actually talk to it (ping the server)

and after we will go futher

[maple-palo]

sorry to confuse with my sentence. actually we are using both telnet and filzilla to test. everytime i did some change. but both doesnt work. if set to any any no problem both using telnet and filezilla to test.

[maple-palo]

oh sweet **bleep**!!!its working now haha. the custom application works. its just that i didnt choose "application-default" on the service portion. after i changed it, tested working =)..so this link is working.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-Po...

thanks a lot for all who replied on this ! really really appreciate it. God bless u all

[reaper]

so after taking out the service object for 9122 and replacing it with app-default it started working ?

if you look at the properties of the service object, does it look like this: