topic FTP on non-standard port (sk43597) in Firewall and Security Management

FTP on non-standard port (sk43597)

Michael_Horne — Thu, 02 Apr 2020 09:48:10 GMT

Hello,

I am looking at how to support FTP on a non-standard port. I found a related SK,but it does not mention and version in the R80 version.

Does anyone have experience with FTP on non-standard ports in R80. Do we still need to apply all the steps in this SK? I would like to avoid having to open up high ports for the FTP data connection. This SK specific mentions having to manually update files on each Security Gateway to configure the Security Gateway to listen to FTP connections on the desired port

Many thanks,

Michael

Re: FTP on non-standard port (sk43597)

G_W_Albrecht — Thu, 02 Apr 2020 12:40:53 GMT

This sk only shows how to handle this situation using an added Service in Dashboard and a new line in $FWDIR/conf/fwauthd.conf file. Not so hard to try and may work in R80.xx, too.

Re: FTP on non-standard port (sk43597)

RickHoppe — Thu, 02 Apr 2020 13:44:27 GMT

I would start with creating a new TCP service, select FTP protocol and specify a custom port.

Re: FTP on non-standard port (sk43597)

Timothy_Hall — Fri, 03 Apr 2020 12:54:53 GMT

I'm pretty sure you don't need to update fwauthd.conf unless you are doing some kind of legacy User/Session/Client authentication for FTP. However an FTP service on a non-standard port needs to be set up correctly so the firewall can properly sniff PORT commands and pinhole open the necessary data ports. This is why FTP control connections (port 21) always go F2F (but the data connections can be accelerated by SecureXL). What you should be able to do is clone the existing FTP service, then edit the name and port number like this:

Use this new service explicitly in your Network rules and you should be good to go.

Re: FTP on non-standard port (sk43597)

PhoneBoy — Fri, 03 Apr 2020 00:28:32 GMT

These instructions involve the FTP Security Server which, unless you still have rules with Action: User Auth in your rulebase, is completely irrelevant.
Create a service as Rick Hoppe suggests.

Re: FTP on non-standard port (sk43597)

Michael_Horne — Mon, 06 Apr 2020 07:13:13 GMT

Hello All,

It would appear that you would only need to create the custom FTP service. I added a feedback comment to the SK and Checkpoint have come back to say that this SK is not relevant to R80.x. I take this to meant that nothing extra needs to be done beyond the customer service.