Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 5 subscribers
  • Views 7738 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Allowing FTPS traffic out through firewall

Andy Banks

I am trying to connect through a Sophos 650 to an external FTPS server, but have been unable to get it working so far. I have found knowledgebase articles about allowing access to an internal FTPS server from outside the network (e.g. community.sophos.com/.../121021) but haven't been able to reverse the process to allow access out to an external FTPS server.

Does anyone have any experience in doing this? I have set up firewall rules that I believe should allow access out, but the connection attempt seems to fail on one of those rules. I think that the initial FTP connection on port 21 works, but fails when switching over to the secure ports. I have tried various settings using the FTP Proxy, FTP helper, firewall rules and all sorts of things but all I seem to be achieving is confusing myself. If anyone can give me any pointers I would be most grateful.

An example log from WinSCP would include the following lines, if this is of any help:

. 2017-10-31 11:36:53.289 Connected with <external server>, negotiating TLS connection...
< 2017-10-31 11:36:53.289 220 Microsoft FTP Service
> 2017-10-31 11:36:53.289 AUTH TLS
< 2017-10-31 11:36:53.289 234 AUTH command ok. Expecting TLS Negotiation.
. 2017-10-31 11:37:08.261 Timeout detected. (control connection)
. 2017-10-31 11:37:08.261 Connection failed.
* 2017-10-31 11:37:08.277 (EFatal) Connection failed.
* 2017-10-31 11:37:08.277 Timeout detected. (control connection)
* 2017-10-31 11:37:08.277 Connection failed.

Thanks,

Andy



This thread was automatically locked due to age.
  • 0

    My advise is forget the ftp proxy because you got more problems as before ;-)

    For my understanding you are located inside your lan and simply want to connect to an external server with the protocol ftps?

    Then maybe give us some more information. Are you using web protection and how? That mean in transparent or non-transparent mode.

    And give your rule of allowing as implemented and maybe a piece of log of the utm.

    Best

    Alex

    -

  • 0

    Internal - using service 990 tcp/udp - going to any - allow

    (Create FTPS Service first with port 990)

Unfiltered HTML