Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 2879 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Passive FTP access from Sophos Connect Client to external server blocked

Nez_Pottage

We have recently setup a new XG running OS 18.0.4.

We have remote client using Sophos Connect.

We also have an Azure based web server, off site (obviously) that is locked for FTP access ONLY to our office WAN IP.

From the office, no outgoing ports are blocked, and the VPN zone is allow all port access to remote servers.

Now if I run a Passive FTP connection through the VPN to the Azure server, I get Firewall errors of Invalid Traffic - Denied from a random port usually to port 21, or from 21 to the WAN IP.   In addition, the file transfers often fail, but not all the time, as in if I upload a folder of items, some make it through and some error.

But if I do the same task from a machine sat in the office, it seems to copy ok, although it does seem to hit errors in the firewall log still.

On our old Sonicwall we had no issues doing the same tasks.

Any ideas?



This thread was automatically locked due to age.
Parents
  • 0

    Hello Nez,

    Thank you for contacting the Sophos Community.

    Can you do a drop-packet-capture from the console of the XG ( you can SSH in to the XG using Putty and then press 4>3)

    console> drop-packet-capture 'host x.x.x.x' (x.x.x.x = IP of the FTPserver)

    To see if there is any drop.

    Also if there are no drops, please do a .pcap capture and open it with Wireshark to see if it provides more info

    https://support.sophos.com/support/s/article/KB-000037007?language=en_US

    For the Passive FTP, most likely since it picks a different port it won't work. 

    For the Active FTP can you run this command:

    console> set advanced-firewall ftpbounce-prevention data

    Regards,

  • 0 in reply to emmosophos

    Thanks

    Packet Capture as below, with IP's swapped to x.x.x.x

    Active FTP Transfer (before command from your reply)

     

    Date=2021-03-06 Time=09:42:38 log_id=010202106 log_type=Firewall log_component=Invalid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev= out_dev= inzone_id=0 outzone_id=0 source_mac= dest_mac= bridge_name= l3_protocol=IPv4 source_ip=x.x.x.x dest_ip=x.x.x.x l4_protocol=TCP source_port=49573 dest_port=20 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

    Active FTP Transfer (after command from your reply)

    Date=2021-03-06 Time=09:54:03 log_id=010202106 log_type=Firewall log_component=Invalid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev= out_dev= inzone_id=0 outzone_id=0 source_mac= dest_mac= bridge_name= l3_protocol=IPv4 source_ip=x.x.x.x dest_ip=x.x.x.x l4_protocol=TCP source_port=52750 dest_port=20 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

     

    Passive FTP Transfer

     

    Date=2021-03-06 Time=09:48:09 log_id=010202106 log_type=Firewall log_component=Invalid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev= out_dev= inzone_id=0 outzone_id=0 source_mac= dest_mac= bridge_name= l3_protocol=IPv4 source_ip=x.x.x.x dest_ip=x.x.x.x l4_protocol=TCP source_port=51176 dest_port=3915 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

    However, if I use the same FTP software from a machine on the LAN rather than the VPN, transfers work fine and no packets are dropped.

    I've tried a split tunnel (with FTP server listed in servers to tunnel) and a Tunnel all connection with the same results.

  • 0 in reply to Nez_Pottage

    Hello there,

    Thank you for the follow-up

    Yes for the Active I was expecting to see the correct port for FTP 20, but I wasn’t expecting to see an Invalid_Traffic log.

    Does a regular Ping from the Sophos Connect to the FTP in Azure work or any other type of communication that you can test going there?

    Also just to double confirm this FTP server in Azure is not accessed by IPsec (Xg -- Azure Site-to-Site) correct it’s only Web base.

    Regards,

  • 0 in reply to emmosophos

    Sorry to didn’t make that side clear.  
    Weirdly, some files are actually transferred, but some error.  No pattern that I can see. 
    mom ftp I can create folders, navigate, delete etc, but if I upload a number of files, it will often error and show the drops in firewall. 
    I can ping, rdc, web without issues so far.  Just the FTP. 
    But if I sit on the LAN and do the same tasks it works.  
    There is no secure link / vpn / other to azure.  Purely just our WAN IP allowed through the firewall on relevant ports. 

Reply
  • 0 in reply to emmosophos

    Sorry to didn’t make that side clear.  
    Weirdly, some files are actually transferred, but some error.  No pattern that I can see. 
    mom ftp I can create folders, navigate, delete etc, but if I upload a number of files, it will often error and show the drops in firewall. 
    I can ping, rdc, web without issues so far.  Just the FTP. 
    But if I sit on the LAN and do the same tasks it works.  
    There is no secure link / vpn / other to azure.  Purely just our WAN IP allowed through the firewall on relevant ports. 

Children