topic FTP permitted by default in Network Security

FTP permitted by default

Gbgreat — Fri, 07 Jun 2019 12:54:27 GMT

I have a server on my DMZ that runs a service on FTP.

I do not have an access-list permitting traffic from outside to the DMZ on ftp.

FTP is not inspected on the global policy

But the FTP service is accessible from the outside network.

Is there any reason? and how can this be stopped.

Also note an access list has been configured to deny, however it still persist.

Re: FTP permitted by default

GRANT3779 — Fri, 07 Jun 2019 20:12:30 GMT

Is this a publicly accessible server that sits on the DMZ via NAT?

We would really need to see some config otherwise it would all be guess work.

Some questions..

What are the security levels on the interfaces?

You mention a deny ACL also.

Does this reference real/mapped address if NATd?

What interface and what direction is the ACL applied.

Most helpful would be source / destination IP and config output.

Re: FTP permitted by default

Mohammed al Baqari — Sat, 08 Jun 2019 07:29:06 GMT

What is the security level assigned to dmz and outside interface. Most
likely outside security is higher than dmz. Or they are same and
same-security inter interface is enabled.

Re: FTP permitted by default

Martin L — Sat, 08 Jun 2019 18:17:57 GMT

disable it/ block it