FTPS

[#1]

I am setting up a FTP over SSL server for my company. I have everything setup and working internally. I have created profiles and the firewall policy for accessing the site externally but cannot get it working. If I turn off the SSL settings on my FTP server I can connect with no issues. I wondering if there is a port # that I have forgotten to forward or some odd setting in my 300A I am not aware of. Other info: I use SSL for my exchange server with no issues SSL/TLS port: 990 passive port: 60100-60200 ftp port: 21 (will change this once I get it working)

[doshbass]

I don' t have an answer here, but I would do a network trace without the FG to see what ports are being used just in case.

[#3]

Using CurrPorts (http://www.nirsoft.net/utils/cports.html) I can see that the server is using ports: 21 990 14147 (admin interface) 1086 (server interface) I have a remote FTP over SSL connection working to my home PC and it is using ports: 4806-4809 (these map to remote port 1977(my ftp port 21) and also seem to increment on remote server refreshes) 4902 (this maps to my passive ports 601xx, one of these is created for each transfer in effect) Im wondering where these 49xx ports are coming from and if I have to define them as well.

[doshbass]

This doc may help www.studentclearinghouse.org/ftps/pdfs/SecureFTP_FirewallGuide.pdf

[red_adair]

hhhmm - not sure if this really can work... FortiOS run several so called session-helper that parses different protocols that negotiate dynamic channels - like active-ftp would do for example. Where you have your control channel, and your data channel - the datachannel traffic (coming back) must be " opened" temporarily. same for many other protocols (you may check for session-helper in the docs) for ftps the communication is encrypted - hence a parser cannot determine on what port the protocols are negotiating. Is there something like " passive ftps" in case ? otherwise you may statically open the incoming data ports - which may be an issue in terms of security. most obvious we may not mix up SFTP and FTPS ;) i never used FTPS before - just zapping through the RFC ;) http://tools.ietf.org/html/rfc4217 Section 7 may be of interest . -R.

[#6]

Just so we are clear I am looking for FTPS not SFTP. I have ports (or so i believe) 21, 990 TCP/UDP open and forwarding to my server. Am I missing something?

[#7]

Hi, you must forward 60100-60200, too. As red.adair explained the FG cannot know that your FTP-Server told the client to connect to say port 60101 because the session-helper does not see the server' s response. I' d probably use a static mapping (full IP forward) for a FTP server. Also make sure to use Passive-FTP on the client side. Otherwise you' ll have to allow IIRC 989 -> Any outbound. Regards