topic Secure FTP through PIX Firewall in Network Security

Secure FTP through PIX Firewall

Deanna — Fri, 21 Feb 2020 06:46:24 GMT

We are trying to do Secure FTP to a server on port 21 through our PIX Firewall running 6.2(2). I have the "fixup protocol ftp 21" statement in the PIX. I can see the connection begin on port 21 but then I see the traffic getting blocked in my syslog. The traffic that is getting denied is between the workstation and the server both talking on high ports. I am wondering if the fixup cannot detect which high ports the conversation is moving to because the traffic is encrypted? Has anyone else worked with this or been able to get Secure FTP to work through the PIX?

Thanks,

Deanna

Re: Secure FTP through PIX Firewall

aacole — Fri, 30 May 2003 13:14:14 GMT

Deanna,

You are correct in your thinking, the fixup cannot track the high port allocated by the PORT statement over the encrypted data channel.

I was reading yesterday the ftp fixup details for 6.3, there was no mention of support for any form of secure FTP. Even more confusing I see there are 2 types of secure FTP, one based on SSL, the other on SSH2.

Andy

Re: Secure FTP through PIX Firewall

michaand — Fri, 30 May 2003 14:20:51 GMT

Is there a passive option you can use with the Secure FTP?

Re: Secure FTP through PIX Firewall

scottmac — Fri, 30 May 2003 14:58:20 GMT

I use SFTP via SSH / OpenSSH through the PIX (501 / 6.2(2) and 6.31) with no problems.

Also, if you allow it, other protocols can be tunneled as well.

Check out the info at OpenSSH.org, VanDyke.com (SecureCRT and other SSH applications), or F-Secure (fsecure.com, I think).

BTW: SSH will run everything through port TCP/22.

Good Luck

Scott