SilverShield SFTP behind XG

Are really going to NAT SSH to a Server? From ANY? I would highly recommend to not do that. 

What' the best practice? What do you suggest? I want to make it right :) Thanks

It highly depends on your scenario, but It's never recommended to open up SSH to the Internet, on almost all scenarios your better off setting up a VPN such as SSLVPN at the firewall so you have a secure way to SSH to the server.

But of course, If the SilverShield SFTP Server supports public key authentication, and have login rate limit set up; Or you have a lot of users who wouldn't be able to use a VPN, then It's "fine" to open up to the internet.

If you still want to setup a DNAT to the server, you can check out this Recommended Read for XG v18. After setting up the NAT Rule you will need to create a Firewall Rule to allow the traffic.

One tip to reduce the amount of brute force attacks (If doing a DNAT) is - If possible use a GeoIP policy.

Example: If your from UK, and all users that will access the SFTP server is from the UK, then within the Firewall Policy you should only allow UK IPs.

Thanks!

Thanks. The Key is: reduce the attack surface. 

Thanks prism. By looking at the UTM dnat, how can I make a same one. We have alot of clients are using the sftp and they are in a few EU, USA, Canada and even in Asia. So want to get It working first then tidy up with proper rules etc.

Regards

First of all, are you on v17.5 or v18?

If you're on v18 I can send you some screenshots on how to do this.

Also, take a look at this recommended read for v18 first. At the WAN-TO-DMZ Traffic section.

Hi Prism

The version on FW is SFOS 18.0.3 MR-3. All I want is to basically, when my client uses the subdomain i set up sftp01.mydomain.com it goes to the Webserver which has silvershield set up and with username and password set up in silvershield to work.

The current setup on UTM works as it is. I just want to set up same here in XG. 

is it possible to do it? atm if i am connected to VPN and use private ip of the server to ssh it works. But what I want basically is that, without VPN when I use the domain sftp01.mydomain.com (which has A record to Firewall's IP) it should go to the Webserver where silverShield is installed.

How to achieve this with a Firewall Rule?

Thanks

Hello

Any update, suggestion? is it doable? 

Hello

Any update, suggestion? is it doable?