Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 29 replies
  • Subscribers 31 subscribers
  • Views 8738 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

MALWARE AND CONTENT SCANNING

Regex

the course is saying that its recommended to use "Malware and content scanning" instead of "Filtering common web ports" So ive done some testing to check if malware will be blocked if i'll set only "malware and content scanning" unfortunately, files sended with no  problem. Ive attached screens from policy of FW rule and ssl/tls rule. Also ive added via Console non-standard port for https and ftp <- but ftp is a different story. 

 

 

BUT if im setting options below(screenshot) it does working. Tested malware are blocked and i can see it in the LOGS.



This thread was automatically locked due to age.
  • 0 in reply to lferrara

    Interesting, i would say, with DPI, yes. 

    For HTTP/s on any Port, it works like this way. Now i am not sure, if the same applies for FTP. 

    But you run in other technical challenges. Is your FTP Client able to work with an Decryption Certificate? 

    Filezilla actually supports that, you could use a Switch to allow Man-in-the-Middle.

    Not sure about other FTP Clients. 

  • 0 in reply to LuCar Toni

    LuCar Toni said:
    But you run in other technical challenges. Is your FTP Client able to work with an Decryption Certificate? 

    Yes, it works!, If you enable TLS Decryption on XG most FTP clients will ask you if you trust the new certificate for the connection. Later on looking at logs you can successfully see that the TLS session has been decrypted.

    The problem here, XG It's not scanning the traffic. Its only scanning default plain-text FTP over port 21.

    On the log viewer and on the Flow Monitor, It doesn't even detect it as FTPS, It shows as TLS connection over non-standard port. While XG in the applications tab have FTPS as a detectable application.

     

    Thanks!

  • 0 in reply to Prism

    Can you please show how did ypu setup you fw policy for ftps traffic also rules for ssl/tls tondecrypt the traffic. ive got set it but cant get work regarding to decrypting traffic in logs. ;]

  • 0 in reply to Prism

    Prism,

    can you try to enable decrypt and scan on the firewall rule where you are allowing the FTPS traffic to see if the malware is detected?

    Thanks

  • 0 in reply to lferrara

    ofcourse ive have set it up but i cant detect any traffic on the rule.

    This is how service is configured. 

    And more detailed 

    ALSO FIREWALL RULE.

    Ticked A security features - maybe here must be selected sth else ?

  • 0 in reply to lferrara

    Hi Luk,

    Already tried this.

    FTPS traffic is decrypted but isn't scanned.

     

    Thanks!

  • 0 in reply to Regex

    I'm using FTPS on passive mode, TLS connection happens over Port 990.
     
    Data is transmitted over Ports 40100:40200.
     
     

     

    Thanks!

  • 0 in reply to Prism

    Please open a ticket with support and report the ID here.

    Regards

  • 0 in reply to lferrara

    I'm a Home User, the best I can do right now is wait for v18.5 and hope something change about how traffic is scanned on XG, Currently with the new DPI engine is only port agnostic for HTTP traffic, I hope it's fully port agnostic in the future.

    Also there's already an Idea, in Sophos Ideas for XG, for FTP scan on any port. The Idea has made in 2017.

    https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/32248618-ftp-tracking

     

    FTP connections are currently only tracked on:

    SFVH_SO01_SFOS 18.0.0 GA-Build321# cat /etc/snort/etc/snort.conf | grep "run ftp servers on" -A 2
    # List of ports you run ftp servers on
    portvar FTP_PORTS [21,2100,3535]

     

    Thanks!