Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 2 subscribers
  • Views 2424 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ftp-ssl / ftp-tls doesn't seem to pass though the astaro box.

rmiddle
I have an astaro 320 but we are having problems with servers behind the astaro getting ftp-ssl connections.  Standard FTP connections inbound work fine but ftp-ssl seem broken.  I have had the ftp proxy both enabled and disabled and still not go.  ftp fine ftp-ssl broken.  I have searched all over and cant find any info on this.  Anyone else have this working?

Thanks
Robert


This thread was automatically locked due to age.
Parents
  • 0
    Check the packetfilter livelog.

    Barry
  • 0 in reply to BarryG
    How coincidental! I had a customer which I upgraded from Version 6 to 7 have this very problem today:  Do you have your HTTP Proxy enabled in transparent mode?  If so, either add the sites that you need to access via SFTP to the skiplist under the advanced tab for the HTTP Proxy, or remove FTP from the allowed protocol list in the Advanced tab.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Reply
  • 0 in reply to BarryG
    How coincidental! I had a customer which I upgraded from Version 6 to 7 have this very problem today:  Do you have your HTTP Proxy enabled in transparent mode?  If so, either add the sites that you need to access via SFTP to the skiplist under the advanced tab for the HTTP Proxy, or remove FTP from the allowed protocol list in the Advanced tab.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Children
  • 0 in reply to BrucekConvergent
    I checked and confirmed HTTP proxy is turned off.  I check the packet filter and it reports blocking the public IP from accessing that IP when using ftp-ssl but not when using ftp.  Does this mean the ftp helper doesn't work using ftp-ssl?

    Thnaks
    Robert
  • 0 in reply to rmiddle
    On what port is it being blocked?  I've found a few secure FTP implementations that require different ports to be opened as well.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to BrucekConvergent
    On what port is it being blocked?  I've found a few secure FTP implementations that require different ports to be opened as well.

    No.  After looking at it.  It looks like the tls/ssl packets can't be read so the ftp helper can't read the packets to find the ports to open.  We are going to simple need to limit the range on port in the ftp server and open those ports up in the router.  It is a pain but that is what we had to do in the cisco for ftp in the 1st place.

    Thanks
    Robert
Cookie Information Banner