Stateful Inspection firewall with passive FTPS( Explicit FTPS ?).

[younghwan_kim]

I looking for a solution with Fortigate(FortiOS) to dynamically open the required FTPS-data port on Firtigate(firewall) with passive FTPS mode.  

Example,

1.When the client initiates a Control session(send Request:PASV), and get Response(with Data Port) from Server.

2.The firewall extracts the Data port number from the Response packet.

3.The firewall then records both the client and server's IP addresses and port numbers in an FTPS-data pending request list.

4.When the client later attempts to initiate a data connection, the firewall compares the connection request's parameters (ports and IP addresses) to the information in the FTPS-data pending request list, to determine whether the connection attempt is legitimate.

5.Since the FTPS-data pending request list is dynamic, the firewall can ensure that only the required FTP ports open.

6.When the session is closed, the firewall immediately closes the ports, guaranteeing the FTPS server's continued security.

My image is "explicit proxy for FTPS" about such as above feature. 

Is it possible with FortiOS?

Best Regards,

Kim 

[blackhole_route]

I’m interested in this as well. The only docs I’ve found indicate that there is no session helper (Alg) for ftps since ftps is encrypted and therefore the data port is not available to the FortiGate to open for the data traffic “pinhole”. http://kb.fortinet.com/kb....do?externalId=FD32835 From what I’ve read elsewhere, the above is true for ftps implicit mode ftps, but ftps explicit mode, passive - does leave control unencrypted at least to the extent that the data ports are able to be read on the wire. And I’ve found that other platforms do support ftpes, passive mode. For example, https://kb.juniper.net/In...content&id=KB19444 But I have not pcapped to confirm and put together a feature request just yet.

[younghwan_kim]

If we configure following workaround solution....

http://kb.fortinet.com/kb....do?externalId=FD32835

After then,Is there no way to control(Block) unsuspected FTPS-data request packet?

For Example using 'tcp_flags' in Session keywords(Custom signature)? 

Best Regards,

Kim 

[ropeguru]

Never mind