Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

FTP on non-standard port (sk43597)

Jump to solution

Hello,

I am looking at how to support FTP on a non-standard port. I found a related SK,but it does not mention and version in the R80 version.

Does anyone have experience with FTP on non-standard ports in R80. Do we still need to apply all the steps in this SK? I would like to avoid having to open up high ports for the FTP data connection.  This SK specific mentions having to manually update files on each Security Gateway to configure the Security Gateway to listen to FTP connections on the desired port 

FTP.pngMany thanks,

Michael

 

0 Kudos
3 Solutions

Accepted Solutions
Highlighted
Silver

I would start with creating a new TCP service, select FTP protocol and specify a custom port.

2020-04-02_15-38-46.png

My blog: https://checkpoint.engineer

View solution in original post

Highlighted

I'm pretty sure you don't need to update fwauthd.conf unless you are doing some kind of legacy User/Session/Client authentication for FTP.  However an FTP service on a non-standard port needs to be set up correctly so the firewall can properly sniff PORT commands and pinhole open the necessary data ports.  This is why FTP control connections (port 21) always go F2F (but the data connections can be accelerated by SecureXL). What you should be able to do is clone the existing FTP service, then edit the name and port number like this:

ftp_999.jpg

Use this new service explicitly in your Network rules and you should be good to go.

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com

View solution in original post

Highlighted
Admin
Admin
These instructions involve the FTP Security Server which, unless you still have rules with Action: User Auth in your rulebase, is completely irrelevant.
Create a service as Rick Hoppe suggests.

View solution in original post

5 Replies
Highlighted
Sapphire

 This sk only shows how to handle this situation using an added Service in Dashboard and a new line in $FWDIR/conf/fwauthd.conf file. Not so hard to try and may work in R80.xx, too.

Highlighted
Silver

I would start with creating a new TCP service, select FTP protocol and specify a custom port.

2020-04-02_15-38-46.png

My blog: https://checkpoint.engineer

View solution in original post

Highlighted

I'm pretty sure you don't need to update fwauthd.conf unless you are doing some kind of legacy User/Session/Client authentication for FTP.  However an FTP service on a non-standard port needs to be set up correctly so the firewall can properly sniff PORT commands and pinhole open the necessary data ports.  This is why FTP control connections (port 21) always go F2F (but the data connections can be accelerated by SecureXL). What you should be able to do is clone the existing FTP service, then edit the name and port number like this:

ftp_999.jpg

Use this new service explicitly in your Network rules and you should be good to go.

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com

View solution in original post

Highlighted
Admin
Admin
These instructions involve the FTP Security Server which, unless you still have rules with Action: User Auth in your rulebase, is completely irrelevant.
Create a service as Rick Hoppe suggests.

View solution in original post

Highlighted

Hello All,

 

It would appear that you would only need to create the custom FTP service. I added a feedback comment to the SK and Checkpoint have come back to say that this SK is not relevant to R80.x. I take this to meant that nothing extra needs to be done beyond the customer service.

0 Kudos