Hi SFTP is a different protocol than FTPS and thus it does things differently. I know of free sftp solutions for windows but I do not know filezilla so I do not know how or what the file transfer console is or what it does. We either use payversions of File transfer software or special software developed by and for us. But I would look into Coreftp wich has some sort of a free version or maybe solarwinds wich has a very small and easy sftp server. or do a google search for free sftp servers. Good luck HTH ... View more

Hi Kristian Sorry for the delayed answer to your post. "That's a stupid answer that completely avoid answering your question." IF the only explanation you have given is the line that you should use SFTP instead then I can understand why this person feels that way, But you did get a more detailed explanation than that. " That is simply not true. FTPS is very firewall friendly, all it requires is a little bit of configuration." I will respond with a more thorogh explanation why this is not right below the line. I still state that FTPS is firewall unfriendly and it should not be used. " Except for the same letters in the name and a similar purpose, FTPS and SFTP are two completely different protocols that have nothing in common. FileZilla Server only speaks FTP(S)." I agree that the 2 protocols have nothing in common. ------------------------ I have extensive knowledge of the three different protocols we are talking about and I manage firewalls that passes traffic from all three of them and sometimes at the same time. Ok here to my explanation. We start at the beginning, in the beginning there was FTP, FTP is a protocol that uses the concept of dynamic opening of ports, ie you have a control channel and when you transfer information you do that over a dynamically opened port. In the beginning this was a big problem for firewalls, how could the firewalls know what ports to open and when to open them. This lead to problems where you had to pre open ports for anyone you wanted to be able to connect with, wich on the internet was just about everyone, and since the ports where dynamically opened you had to open the whole span from 1023 to 65535. Opening all high ports on a machine results in the firewall being unable to help the host staying secure. This as you can understand is a less than desireable result from a security standpoint. Then someone realised that they can take a look in the control channel. This is what cisco called Fixup protocol and now calls inspect, other vendors fx call it Deep packet inspection and ALG Application Layer Gateway and so on. This lets the firewall look into the control channel and open the ports needed for communication when they are needed and only for the intended communication peers ie ftp server/client. With this the hosts where once again protected by the firewall and all seemed well from that perspective. Along comes someone and proclaims rightly that well we have a security problem here the username and password is transfered in cleartext  and all the information that is also transfered in cleartext this is unacceptable. How do we solve this ? well we can do what we did to HTTP and make HTTPS, why not do the same and use SSL/TLS ? thus FTPS is born. So what does this mean ? it means that the control channel now is encrypted but FTP still works in a fundamentally the same way. Since the controlchannel now is encrypted the firewalls are now back to the point before the inspect possibility and that means that it can not help the host to stay secure. We are now back to the point where we have to open all possible ports that might be used (in your case you have closed it down to 50000-50030) to anyone who might want to use the ftps server and the ports needs to be always open. This creates a hole in the firewall protection of your host. This is also why I call the protocoll firewall unfriendly. SFTP does not have this problem since it does not use dynamically opened ports. This is the reason why we are leaving ftps and ftp and moving to sftp and why I recomend that solution. I speak to customers who want to use FTPS atleast one or twice a month mostly due to IIS servers and microsoft software. Sometimes they have made adaptations to their software and then i get to hear the same arguments as you have heard and I have to explain to them (customers and app developers)  that getting the traffic through the firewall is not a problem per se, its not dropping the security stance that is the problem. That we can get the traffic through the firewall does not mean the firewall supports it. There is a difference. Hope this clears up things a bit. To make your stuff work with the firewall you need to allow the port you have choosen as control channel and ports 50000-50030 from anyone talking to it in your access-lists towards your unit and if you are using PAT/nat you need to pat/nat all ports involved too. When it comes to filezilla supporting or not supporting ofcourse a developer of a software who does not have a functionality will want to stear you towards a functionality they have. That is just human nature. Good luck HTH ... View more

You will "always" have problems with FTPS through a firewall. This is due to the fact that FTPS is firewall unfriendly protocol and something that should not be used in a modern world. You are better of using fx SFTP. So if you have the possibility my best advice would be to switch. This is a general problem with the protocol itself not the firewall. The issue is that basically you will have to choose security or functionality you can not have both. ie do you want security then you can not make FTPS function in an ASA. This is due to the fact that the port and other information is exchanged between the server and the client within an encrypted environment that the firewall does not have access to, so to make FTPS work through the firewall you will have to lower the defences ie let everything through that the FTPS server might want to open up ports for wich normally would mean any port 1023+. Historically In FTP this problem is mitigated due to the inspection of FTP control packets so that the firewall knows what the server and the client agrees upon when it comes to ports and so on and can tae apropriate action. Ofcourse someone thinks (and is right) that FTP is not safe enough beeing in cleartext and all that, So how do we fix that it is not safe enough ? why dont we just SSL encrypt it like we did with HTTP and presto FTPS is born, with all the historical problems of FTP. There are some mitigations to this problem in FTPS ie you can in some server software choose a narrower range of ports, but the basic problem is today unavoidable. SFTP does not have this limitation due to it beeing a totally different protocol and firewall friendlier. ie everything goes on the same port so if it is possible I strongly urge you to go with SFTP instead of FTPS.. Good luck Hope This Helps ... View more

I am guessing we are talking about cleartext throughput here ? Then every single ASA supports 30 Mb or more of cleartext throughput. However if you are talking about a 30 Mbit link to fx a website on a dmz then some servers and so on on the inside. Remember that the traffic from the inside to the DMZ and vice verse needs to be taken into calculation. Hope This Helps /Hobbe ... View more

Hi There seems to be a confusion regarding the type of transfer FTP = File transfer protocol This is unencrypted and it not possible to properly secure the transfer with this protocol. FTPS FTP over SSL This is just normal FTP encrypted with SSL/TLS with all the drawbacks that comes with that solution. This is a firewall unfriendly solution. SFTP SSH File Transfer protocol This is "secure" from the start and firewall friendly. I have done several of these solutions before and as a general point when you raise the concerns you have they tend to listen and make a solution available. So if they have FTP server as you state in your first post ,then there is no way to do this in a secure manor. The best you can do is encrypt the file itself but that is at best a questionable solution. If the Server is FTPS as you stat in your second post then the protocol in itself is encrypted and you are "secure" but you will have to open much more ports than you would like to open in the firewalls. One thing you could do to circumvent the problem is that you are getting a SFTP server on your end and let them come and get the file there. Good luck HTH ... View more

Hi You state that the file has to be encrypted from what time ? Well there is no such thing as "securely sent over the internet to an ftp server" Ftp is in itself cleartext so you will be able to sniff username and password, you are also able to do MITM attacks and so on. What do you mean with an "OPEN Ftp server" ? If you want to send the file to a FTP server then you need to secure that transfer with a encrypted tunnel of some sort. (VPN) If you are able to change the solution to SFTP instead of FTP then that would provide the encrypted tunnel for you. A word of warning, stear clear of FTPS it is not firewall friendly. Good luck Hope This Helps ... View more

Hi Well there are several ways you can handle this. but lets first make it the way it is supposed to be handled. 1) is she breaking any IT policy ? If yes then let HR deal with the offending programmer, just make sure that they have enough proof to swat the offender hard. If the answer is no, no policy of the company is broken then frankly I doubt that it is your responsibility to fix the problem, wich in this case is that the IT policy is lagging behind what is desireable. Lets ignore the above part and check on what you asked for. First of all since  the machine is a vm machine in an esx host you will have problems to halt traffic simply because not all traffic does leave the ESX host. So what can you do ?  Is the ip address static or dynamic ? If it is a static ip address then you can easily write an ACL that allows what she is supposed to be able to do from that machine and then block the rest from that particular machine and then allow everything else. Since you did not have an ACL from the beginning this should only impact her ability to scan. If the 3750 software is quite new you can setup an ACL with a connection to an EEM and TCL script that IF she starts to scan you can block her address via adding a new acl or the switch sends you an email or anything you can imagine inbetween. If the ipadress is DHCP then you can either choose to lock it down to a specific address in the dhcp scope or you can setup something that lets you know what it is and sets a scripted acl. So what other things can you do ? You could set a MAC address access-list and shut down the Mac address passing through the switch. You can do alot of other things like poisoning the arp address table of the machine, and make things not work the way she wants it. duplicate ip addresses and mac addresses or maybe duplicate windows name. But that sort of thing can backfire and to be honest, that does not sound like the doings of a person who are in charge of the network and so on.. I would go for the first alternative ie make sure that what she is doing is not ok according to policys, let her know that it is not ok and if she persists in her doings turn her over to the HR department. Good luck ... View more

Hi It seems like you have the same problem that I have had some experience with.. What I do is generally just loosen the cable and replace with a new cable if i have one. That normally does the trick. If you have no new cable to use then just remove the cable and flip it over so that the end that was in switch 2 now points to switch 1 and attach it again. Most of the time this fixes the problem, it seems like the cable is very sensitive to be placed a little out of place. background infor that might be good to have. The stacking cables actually work by chaining together the different stacks in two bi directional rings. So when you break the stack ring by removing the cable the ring just lost half its speed and the redundancy to have two ways to move data between the different switches, Thats why you can remove and replace the cable without the stack breaking apart. Good luck HTH ... View more