Security policy rule - allowing a specific host access to ftp.sophos.com

Reply
Highlighted
L2 Linker

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Hi DPoppleton,

 

Still not working.

 

I get this from the log in the Filezila FTP client. 

sophos error.PNG

 

Filezila client configured as so for FTP over SSL/TLS

Filezila config.PNG

 

Logs from Unified today.

Unified log.PNGAny further advice will be appreciated.

Highlighted
L3 Networker

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

This isn't caused by the firewall.... I seem to remember a problem with the MLSD command with certain clients or servers while running a passive FTP connection. Try it as an active connection and I think it would work.

Highlighted
L0 Member

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Thanks for the info on allowing a specific host access to ftp.sophos.com jira 

An experienced self-starter, avid learner and problem solver, working as an Business Analyst at Mindmajix.com
Highlighted
L1 Bithead

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Very important this is NOT sftp (which is a file transfer protocol using the same port and encryption as ssh). We are talking about ftp over ssl.

 

this is explicit ftp over ssl. Meaning the client wil use ftp to connect to ftp.sophos.com and than do TLS encryption and than with an encrypted connection it will do authentication and negotation which ports to use for the data connection.

 

fom https://community.sophos.com/kb/en-us/113454

 

you will need to allow the application: ftp to connect to tcp port 990 for ftp.sophos.com.

 

after that you will need to allow the application ssl with ports 50000-51000

Highlighted
L2 Linker

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Hi Rikkert_Kooy,

 

Thank you for your reply. My mistake, it is explicit FTP over SSL, not SFTP.

 

I have added ftp to the Application and already had TCP port 990 under the Service. I also added SSL and the port range 50000-51000, but it is still not working. The Palo is not configured for SSL decrypt/encrypt. Could this be why it is still not working?

 

sophos rule.PNG

 

Unified logs - it says incomplete in Application. What does this mean please?

 

sophos error on palo.PNG

 

Error message on the Filezilla client

 

ftp client error.PNG

 

Thanks.

 

 

 

 

Highlighted
L2 Linker

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Hi DPoppleton,

 

I set the Transfer Settings to Active in the FTP client (I guess this what you meant), but still not working. I did what Rikkert_Kooy suggested too and still no joy. Is it because the Palo is not configured with SSL decrypt/encrypt?

 

Thanks.

Highlighted
L1 Bithead

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Hi rchung54,

 

decrypting ssl traffic is not strictly needed to make this connection possible. I have configured passive ftp with explicit ssl in this way before.

 

I see that your rule is being hit for the passive connection on port 50661 (your filezilla screenshot shows that the client is trying to connect to 195.171.192.29:50661 (197*156+227)), but your ftp client either says the connection has timed out or that the server denied the connection (were the three error messages at the same time?).

 

What does your Palo alto say is the reason for the session end reason? 

Highlighted
L2 Linker

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

Hi Rikkert_Kooy,

 

Yes, i saw the three error messages at the same time on the Filezilla client.

 

The Session End Reason is 'tcp-rst-from-server'. 

 

Palo session end reason.PNG

 

What does it mean where it says 'incomplete' under Application please?

 

Thanks.

Highlighted
L1 Bithead

Re: Security policy rule - allowing a specific host access to ftp.sophos.com

incomplete means not enough packets have gone through the Palo Alto for it to recognise the application. So it doesn't know yet whether it is SSL (which the rule allows) or something else.

 

If I read the session end reason it seems like the ftp.sophos.com causes the disconnect, but likely because the client was trying to connect to it for 20 seconds.

 

Why your FTP client wasn't able to actually connect to the server in passive mode I do not understand.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!