1. Home
  2. Networking Firewalls
  3. Netscreen Passive FTP question

Netscreen Passive FTP question

I'm still kinda new at this so bear with me. Have a Netscreen 5GT and we're setting up a Linux FTP server on our DMZ. We will have the Linux server configured for pasv ftp. My question is regarding the firewall config...do I need to allow all ports over 1024 to the FTP box? Or is there something the netscreen does automatically so I don't have to open all those ports? My understanding is the pasv ftp server will tell the client what port above 1024 to use so we need those ports open to the box...can the netscreen "see" this request and automatically open the proper ports? Or am I reaching here?

Reply to
The Other Mike
Loading thread data ...

Please think about the fact, that FTP is very ugly, and there are much easier protocols out there, like HTTP/WebDAV, and much more secure ones like HTTPS, SSH/SCP or SFTP.

Yours, VB.

Reply to
Volker Birk

Reply to
The Other Mike

The Other Mike wrote: [FTP server]

Then perhaps this will help you:

formatting link
Yours, VB.

Reply to
Volker Birk

Thanks for the link...but I have reviewed this already and it doesn't specifiy anything about passive ftp. I'm concerned about specifically a pasv ftp setup...I know this procedure will work with active ftp ....but with a passive setup, do I need to open up the additional above

1024 ports? Or does the firewall handle this?
Reply to
The Other Mike

What version of code are you running? Late 4 and all 5. code should have "application" settings besides just the service. When you select the FTP application as well as the FTP service in your policy, it should take care of that for you.

-Russ.

Reply to
Somebody.

No...I don't know this which is why I posted the question. I've read alot of the netscreen documentation and it says it "supports active and passive ftp"....I'm just not sure if that means "stateful handling". I guess I'll just give them a call. Thanks.

Reply to
The Other Mike

The Other Mike wrote:

formatting link
Thanks for the link...but I have reviewed this already and it doesn't

Sorry. I can explain to you, how passive FTP works (RFC 959), but I usually don't use this netscreen stuff, so I know perhaps too less about this special device to help you.

With passive FTP, the FTP server tells the client, on which (random) port it will listen for the data connection. A firewall therefore must read the FTP command traffic, so it then can (statefully) allow the data connection.

It is not a good idea to unblock anything above 1024, though.

So perhaps it will be best to read the netscreen documentation, how to activate stateful handling of the FTP protocol, also for passive FTP connections. I guess, they will have one (in fact, I thought, that this is enabled as described in the above link).

Are you sure, that your firewall does this not automatically without the need to configure something speacial, if you allow FTP?

Yours, VB.

Reply to
Volker Birk

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.