topic ftp protocol-download policy can not matched in General Topics

ftp protocol-download policy can not matched

Jeff_Gao — Fri, 20 Nov 2020 08:24:45 GMT

Dear

I want to limit ftp client only download and can not upload,I try to configure policy as follow:

But the traffic from client to ftp server can not match the policy,it's matching the cleanup rule.

R55 is working well,I just configure the policy in R80.40 and same the R55,but no working,pls help!

Re: ftp protocol-download policy can not matched

CPRQ — Fri, 20 Nov 2020 15:01:36 GMT

We have some other ftp issue when move from R77 to R80.20. We used sk45085.

fw ctl get int fw_ftp_allow_double_parenthesis_termination
fw_ftp_allow_double_parenthesis_termination = 0

fw ctl set int fw_ftp_allow_double_parenthesis_termination 1

fw ctl get int fw_ftp_allow_double_parenthesis_termination
fw_ftp_allow_double_parenthesis_termination = 1

Re: ftp protocol-download policy can not matched

PhoneBoy — Fri, 20 Nov 2020 16:33:58 GMT

In R55, this was done using the Security Servers.
I’m guessing you are doing this with App Control.
Are you sure the FTP connection is not TLS encrypted?
That may make detection of this…problematic.

Re: ftp protocol-download policy can not matched

Jeff_Gao — Sat, 21 Nov 2020 10:02:19 GMT

yes,there is no tls encrypted,you can demo it.

Re: ftp protocol-download policy can not matched

Jeff_Gao — Sat, 21 Nov 2020 10:02:52 GMT

but i no enable anti-virus,i just enable app&url .

Re: ftp protocol-download policy can not matched

PhoneBoy — Sun, 22 Nov 2020 00:43:01 GMT

Recommend a TAC case.

Re: ftp protocol-download policy can not matched

Jeff_Gao — Sat, 26 Dec 2020 08:57:27 GMT

I have solved it by two policy:

policy one:

source:ftp client dest:ftp-server services/applications:ftp porotocol-upload action:drop

policy two:

source:ftp client dest:ftp-server services/applications:ftp action:allow