12-20-2023 02:11 AM
Hello,
I'm currently managing an SFTP (SSH) server.
I'm attempting to implement file blocking using the NGFW.
I've configured a decryption profile that includes "SSH Proxy".
According to the traffic logs, the "decrypt" option appears to be activated. However, I'm not observing any files in the data filtering logs, even though logs for other files from other https policies decryption are visible.
12-20-2023 06:45 AM
Hi @chens ,
I have recently research similar use case, but unfortunately it doesn't seems possible with Palo Alto FW.
As you can see in the official documentation SSH Proxy (paloaltonetworks.com)
SSH Proxy will mainly try to identify if SSH is being used for tunneling other traffic. If it detects tunneled traffic it will block it, but if simple SSH or SFTP or SCP it will allow it.
The link above explicitly mentioned that FW will not perform any content inspection for tunneled traffic (port forwarding or X11), but it does not mention if it will perform content inspection for allowed SSH/SFTP/SCP.
However my assumption is that it doesn't, based on the fact that:
- There is no application signature for SCP or SFTP
- FTP application does not have secure ports (like HTTPS), which means FTP protocol decoder is not used for inspecting SFTP traffic and therefor impossible for the firewall to make sense
- Othere people have asked the same question long time ago and get our results - https://live.paloaltonetworks.com/t5/general-topics/data-filter-with-ssh-proxy-decryption/td-p/9589
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
