Security policy rule - allowing a specific host access to ftp.sophos.com

[rchung54]

Hello,

A colleague needs to access ftp.sophos.com (195.171.192.29) using Filezilla as their SFTP client, via TCP port 990. I set up the security policy rule as follows:

They could not log onto the ftp.sophos.com site. The password credentials they used are correct. Is the rule set up correctly? On a Cisco ASA I would have used the following ACL:

access-list aclinside extended permit tcp any host 195.171.192.29 eq 990

Any advice is much appreciated.

Regards,

Roberto

[Hodor]

Hi, as i can see at the last image you're using Profile Groups (in your case SPG_Outband). Have you also checked, that the "File Blocking Profile" for this group is set allowed / in alert mode? It may be that everything is blocked here.

[DPoppleton]

I've had to add the SSH application to many SFTP rules, as the firewall usually sees that. Look in your Unified Logs and it should show you why it was denied.

[rchung54]

Hello Hodor,

Thanks for your reply. The file blocking profile looks good.

[Brandon_Wertz]

Like @DPoppleton mentioned what do the deny logs say is the reason for traffic being stopped?  What is the FW seeing?  

[rchung54]

Hi DPoppleton,

I don't see any 'deny' in the Actions when the user is trying to access 195.171.192.29

 

[DPoppleton]

That screen shot shows the application as FTP, which means the FileZilla client isn't encrypting. The client may need to be set to use SFTP (and the firewall will see that as SSH, so you will need to add that application to your rule.)

[rchung54]

Hi DPoppleton,

Thanks for your reply again. I have now added SSH under Application within my rule.

I will have the user test.

Many thanks,

Roberto 

[rchung54]

@DPoppleton, forgot to mention that the Filezilla client was configured for SFTP and was tested on a ADSL line and the user was able to connect fine.

Thanks,

Roberto

[DPoppleton]

Have you found a solution to this issue yet?