Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 2879 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Passive FTP access from Sophos Connect Client to external server blocked

Nez_Pottage

We have recently setup a new XG running OS 18.0.4.

We have remote client using Sophos Connect.

We also have an Azure based web server, off site (obviously) that is locked for FTP access ONLY to our office WAN IP.

From the office, no outgoing ports are blocked, and the VPN zone is allow all port access to remote servers.

Now if I run a Passive FTP connection through the VPN to the Azure server, I get Firewall errors of Invalid Traffic - Denied from a random port usually to port 21, or from 21 to the WAN IP.   In addition, the file transfers often fail, but not all the time, as in if I upload a folder of items, some make it through and some error.

But if I do the same task from a machine sat in the office, it seems to copy ok, although it does seem to hit errors in the firewall log still.

On our old Sonicwall we had no issues doing the same tasks.

Any ideas?



This thread was automatically locked due to age.
Parents
  • 0

    Hello Nez,

    Thank you for contacting the Sophos Community.

    Can you do a drop-packet-capture from the console of the XG ( you can SSH in to the XG using Putty and then press 4>3)

    console> drop-packet-capture 'host x.x.x.x' (x.x.x.x = IP of the FTPserver)

    To see if there is any drop.

    Also if there are no drops, please do a .pcap capture and open it with Wireshark to see if it provides more info

    https://support.sophos.com/support/s/article/KB-000037007?language=en_US

    For the Passive FTP, most likely since it picks a different port it won't work. 

    For the Active FTP can you run this command:

    console> set advanced-firewall ftpbounce-prevention data

    Regards,

  • 0 in reply to emmosophos

    Thanks

    Packet Capture as below, with IP's swapped to x.x.x.x

    Active FTP Transfer (before command from your reply)

     

    Date=2021-03-06 Time=09:42:38 log_id=010202106 log_type=Firewall log_component=Invalid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev= out_dev= inzone_id=0 outzone_id=0 source_mac= dest_mac= bridge_name= l3_protocol=IPv4 source_ip=x.x.x.x dest_ip=x.x.x.x l4_protocol=TCP source_port=49573 dest_port=20 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

    Active FTP Transfer (after command from your reply)

    Date=2021-03-06 Time=09:54:03 log_id=010202106 log_type=Firewall log_component=Invalid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev= out_dev= inzone_id=0 outzone_id=0 source_mac= dest_mac= bridge_name= l3_protocol=IPv4 source_ip=x.x.x.x dest_ip=x.x.x.x l4_protocol=TCP source_port=52750 dest_port=20 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

     

    Passive FTP Transfer

     

    Date=2021-03-06 Time=09:48:09 log_id=010202106 log_type=Firewall log_component=Invalid_Traffic log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev= out_dev= inzone_id=0 outzone_id=0 source_mac= dest_mac= bridge_name= l3_protocol=IPv4 source_ip=x.x.x.x dest_ip=x.x.x.x l4_protocol=TCP source_port=51176 dest_port=3915 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

    However, if I use the same FTP software from a machine on the LAN rather than the VPN, transfers work fine and no packets are dropped.

    I've tried a split tunnel (with FTP server listed in servers to tunnel) and a Tunnel all connection with the same results.

  • 0 in reply to Nez_Pottage

    Hello there,

    Thank you for the follow-up

    Yes for the Active I was expecting to see the correct port for FTP 20, but I wasn’t expecting to see an Invalid_Traffic log.

    Does a regular Ping from the Sophos Connect to the FTP in Azure work or any other type of communication that you can test going there?

    Also just to double confirm this FTP server in Azure is not accessed by IPsec (Xg -- Azure Site-to-Site) correct it’s only Web base.

    Regards,

  • 0 in reply to emmosophos

    Sorry to didn’t make that side clear.  
    Weirdly, some files are actually transferred, but some error.  No pattern that I can see. 
    mom ftp I can create folders, navigate, delete etc, but if I upload a number of files, it will often error and show the drops in firewall. 
    I can ping, rdc, web without issues so far.  Just the FTP. 
    But if I sit on the LAN and do the same tasks it works.  
    There is no secure link / vpn / other to azure.  Purely just our WAN IP allowed through the firewall on relevant ports. 

  • 0 in reply to Nez_Pottage

    Hello Nez,

    Thank you for the info.

    Can you check if you have IPS enabled for this traffic, if you do please disable it.

    Also, can you confirm if you’re using Web Proxy in the Firewall Rule for the Sophos Connect going to the WAN?

    Regards,

  • 0 in reply to emmosophos

    No IPS or web proxy on the Sophos Connect to WAN rule.

    Rule screenshot attached if it helps.  Destination network is set to ANY.

  • 0 in reply to Nez_Pottage

    Hello there,

    Thank you for the screenshots, all seems correct.

    I am not sure if DPI might be causing some interference (I don't think, but you can add the Sophos Connect Range to the SSL/TLS inspection rules).

    If this is still failing, open a case with Support and share the Case ID, more investigation would be needed.

    Regards,

  • 0 in reply to emmosophos

    Thanks.

    Case raised under 03753709.

    So far I have been told the mac client is out of date, even though it's the latest version on my XG.

    Although if I try to download via the client log in, not the admin, I get an error "Requested file could not be provided. Make sure Pattern Updates are working correctly.
    You can find it under 'Backup & Firmware' -> 'Pattern Updates'"

    Pattern updates are all up to date, but I saw another discussion that this error is a known issue being worked on.

Reply
  • 0 in reply to emmosophos

    Thanks.

    Case raised under 03753709.

    So far I have been told the mac client is out of date, even though it's the latest version on my XG.

    Although if I try to download via the client log in, not the admin, I get an error "Requested file could not be provided. Make sure Pattern Updates are working correctly.
    You can find it under 'Backup & Firmware' -> 'Pattern Updates'"

    Pattern updates are all up to date, but I saw another discussion that this error is a known issue being worked on.

Children