- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- Re: FTP on non-standard port (sk43597)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FTP on non-standard port (sk43597)
Hello,
I am looking at how to support FTP on a non-standard port. I found a related SK,but it does not mention and version in the R80 version.
Does anyone have experience with FTP on non-standard ports in R80. Do we still need to apply all the steps in this SK? I would like to avoid having to open up high ports for the FTP data connection. This SK specific mentions having to manually update files on each Security Gateway to configure the Security Gateway to listen to FTP connections on the desired port
Many thanks,
Michael
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would start with creating a new TCP service, select FTP protocol and specify a custom port.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm pretty sure you don't need to update fwauthd.conf unless you are doing some kind of legacy User/Session/Client authentication for FTP. However an FTP service on a non-standard port needs to be set up correctly so the firewall can properly sniff PORT commands and pinhole open the necessary data ports. This is why FTP control connections (port 21) always go F2F (but the data connections can be accelerated by SecureXL). What you should be able to do is clone the existing FTP service, then edit the name and port number like this:
Use this new service explicitly in your Network rules and you should be good to go.
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Create a service as Rick Hoppe suggests.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This sk only shows how to handle this situation using an added Service in Dashboard and a new line in $FWDIR/conf/fwauthd.conf
file. Not so hard to try and may work in R80.xx, too.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would start with creating a new TCP service, select FTP protocol and specify a custom port.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm pretty sure you don't need to update fwauthd.conf unless you are doing some kind of legacy User/Session/Client authentication for FTP. However an FTP service on a non-standard port needs to be set up correctly so the firewall can properly sniff PORT commands and pinhole open the necessary data ports. This is why FTP control connections (port 21) always go F2F (but the data connections can be accelerated by SecureXL). What you should be able to do is clone the existing FTP service, then edit the name and port number like this:
Use this new service explicitly in your Network rules and you should be good to go.
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Create a service as Rick Hoppe suggests.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
It would appear that you would only need to create the custom FTP service. I added a feedback comment to the SK and Checkpoint have come back to say that this SK is not relevant to R80.x. I take this to meant that nothing extra needs to be done beyond the customer service.
![](/skins/images/AB448BCC84439713A9D8F01A2EF46C82/responsive_peak/images/icon_anonymous_message.png)