FTP Backup Configuration

Hi Reem Jalal Eddine Thank you for reaching out to the Sophos community team, Please start TCPDUMP and PCAP capturing on the FTP Server IP and after this please trigger FTP backup manually on the Sophos Firewall, do the same action twice or thrice until the error alerts on UI generates each time. Once recreation is done download the PCAP and TCPDUMP text files and share them via DM.

Sophos Firewall: How to TCPdump
Sophos Firewall: How to TCPdump

Sophos Firewall: Create and download packet captures
https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Note: Please do not share PCAP or TCPDUMP directly here as it may reveal credentials due to plain text FTP communication.

I DMed you. Thank you :) 

Hi Reem Jalal Eddine Thank you for sharing the snapshot via DM, based on the communication exchange  I can see 553 responses. I would suggest checking and validating one more time on the FTP server side why it is generating that code with that response. As you updated it is working fine from testing PC but you may compare both the time logs on the FTP server to see the difference and to get some clue. 



Also, If on the firewall side you have the challenge of capturing the PCAP file, you may capture the same on the FTP server with wireshark installation for both situations ( working one from the test PC and non-working for firewall-generated FTP backup) to compare it and to check the difference in FTP server response...!

Hi Vishal_R Vishal, 

I am suspecting that the file length is too long to be allowed to create on ftp. Is there anyway we can modify the filename to test if that is the reason? Thank you

Hi Reem Jalal Eddine  Without the prefix defined on the UI backup name will use the following format for backup naming:

Without prefix: Backup_<Device Key>_<SFOS version>_<timestamp>

Currently, we do not have any way to change the above within UI settings. 

For testing/having more clarity on backup file name-related doubt, I would suggest doing the reverse testing from the end PC with CMD commands, i.e. from the PC when you are connecting FTP via CMD, use a manually downloaded backup file (locally downloaded backup of the firewall)  to upload it on FTP and if this works then probably file name is not the cause behind an issue..!

Thank you for your help. It turns out I was providing the wrong path, sice I created a user for FTP only I have to create directories under ftpclient not root and it worked. Your troubleshooting helped alot.

Hi Reem Jalal Eddine  Thank you for providing an update on this and I am glad that you managed to fix the issue with the provided hints and points to consider on this kind of issue.