09-11-2012 07:00 PM
Hi Kim,
In order to allow ftps or ftpes we need to do ssl decryptioin. We identify the FTPS control connection as SSL.Since it FTPS is over SSL we donot have any visibility into application and we identify it as SSL connection. If we allow only SSL in our security than we will allow only control connection for the FTPS but not the data connection.
The control session will work fine by just allowing the ssl application but the actual data session (the file transfer) will not work because Paloalto will block that file transfer as that transfer takes on a different set of ports rather than the port 990 that is used for FTPS control connection. So for you to get the FTPS working you will have to do SSL decryption.
I have attached a doc about SSL decryption which I found in the discussions and its really good. Please have a look at it
Thanks,
Sandeep T
