Security policy rule - allowing a specific host access to ftp.sophos.com

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Security policy rule - allowing a specific host access to ftp.sophos.com

L2 Linker

Hello,

 

A colleague needs to access ftp.sophos.com (195.171.192.29) using Filezilla as their SFTP client, via TCP port 990. I set up the security policy rule as follows:

 

Source.PNG

 

Destination.PNG

 

Service.PNGActions.PNG

 

They could not log onto the ftp.sophos.com site. The password credentials they used are correct. Is the rule set up correctly? On a Cisco ASA I would have used the following ACL:

 

access-list aclinside extended permit tcp any host 195.171.192.29 eq 990

 

Any advice is much appreciated.

 

Regards,

 

Roberto

 

 

 

18 REPLIES 18

L1 Bithead
Hi, as i can see at the last image you're using Profile Groups (in your case SPG_Outband). Have you also checked, that the "File Blocking Profile" for this group is set allowed / in alert mode? It may be that everything is blocked here.

L3 Networker

I've had to add the SSH application to many SFTP rules, as the firewall usually sees that. Look in your Unified Logs and it should show you why it was denied.

Hello Hodor,

 

Thanks for your reply. The file blocking profile looks good.

 

File block.PNGFile block.PNG

Like @DPoppleton mentioned what do the deny logs say is the reason for traffic being stopped?  What is the FW seeing?  

Hi DPoppleton,

 

I don't see any 'deny' in the Actions when the user is trying to access 195.171.192.29

 

 Unified log.PNG

 

That screen shot shows the application as FTP, which means the FileZilla client isn't encrypting. The client may need to be set to use SFTP (and the firewall will see that as SSH, so you will need to add that application to your rule.)

Hi DPoppleton,

 

Thanks for your reply again. I have now added SSH under Application within my rule.

 

ssh.PNG

 

I will have the user test.

 

Many thanks,

 

Roberto 

@DPoppleton, forgot to mention that the Filezilla client was configured for SFTP and was tested on a ADSL line and the user was able to connect fine.

 

Thanks,

 

Roberto

Have you found a solution to this issue yet?

Hi DPoppleton,

 

Still not working.

 

I get this from the log in the Filezila FTP client. 

sophos error.PNG

 

Filezila client configured as so for FTP over SSL/TLS

Filezila config.PNG

 

Logs from Unified today.

Unified log.PNGAny further advice will be appreciated.

This isn't caused by the firewall.... I seem to remember a problem with the MLSD command with certain clients or servers while running a passive FTP connection. Try it as an active connection and I think it would work.

L0 Member

Thanks for the info on allowing a specific host access to ftp.sophos.com jira 

An experienced self-starter, avid learner and problem solver, working as an Business Analyst at Mindmajix.com

Very important this is NOT sftp (which is a file transfer protocol using the same port and encryption as ssh). We are talking about ftp over ssl.

 

this is explicit ftp over ssl. Meaning the client wil use ftp to connect to ftp.sophos.com and than do TLS encryption and than with an encrypted connection it will do authentication and negotation which ports to use for the data connection.

 

fom https://community.sophos.com/kb/en-us/113454

 

you will need to allow the application: ftp to connect to tcp port 990 for ftp.sophos.com.

 

after that you will need to allow the application ssl with ports 50000-51000

Hi Rikkert_Kooy,

 

Thank you for your reply. My mistake, it is explicit FTP over SSL, not SFTP.

 

I have added ftp to the Application and already had TCP port 990 under the Service. I also added SSL and the port range 50000-51000, but it is still not working. The Palo is not configured for SSL decrypt/encrypt. Could this be why it is still not working?

 

sophos rule.PNG

 

Unified logs - it says incomplete in Application. What does this mean please?

 

sophos error on palo.PNG

 

Error message on the Filezilla client

 

ftp client error.PNG

 

Thanks.

 

 

 

 

  • 8685 Views
  • 18 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!