Figure 41: Explicit FTP proxy session
From a simple command line FTP client connecting to an the previous sequence could appear as follows:
ftp 10.31.101.100 21
Connected to 10.31.101.100.
220 Welcome to Fortigate FTP proxy
Name (10.31.101.100:user): p-name:p-pass:[email protected] 331 Please specify the password.
Password: s-pass 230 Login successful.
Remote system type is UNIX
Using binary mode to transfer files.
ftp>
Explicit FTP proxy configuration overview
You can use the following general steps to configure the explicit FTP proxy.
To enable the explicit FTP proxy - web-based manager
1 Go to System > Network > Explicit Proxy > Explicit FTP Proxy Options. Select Enable Explicit FTP Proxy to turn on the explicit FTP proxy.
User
FTP client Explicit FTP proxy FTP server
1. FTP client connects to explicit FTP proxy.
3. FTP client sends authentication
and server address to the FTP proxy. 4. FTP proxy forwards the connection request to the FTP server.
7. FTP client sends FTP server password to FTP proxy.
11. FTP client starts FTP session.
8. FTP proxy relays the password to FTP server.
2. Explicit FTP proxy sends Welcome message and
connection prompt.
5. FTP server sends password request to FTP proxy.
9. FTP server sends login successful to FTP proxy.
10. FTP proxy relays login successful to FTP client.
6. FTP proxy relays password request to the FTP client.
The FortiGate explicit FTP proxy Explicit FTP proxy configuration overview
2 Select Apply.
The default explicit FTP proxy configuration has Default Firewall Policy Action set to Deny and requires you to add a security policy to allow access to the explicit FTP proxy. This configuration is recommended and is a best practice because you can use security policies to control access to the explicit web proxy and also apply security features such as logging, UTM, and authentication (by adding identity-based policies).
3 Go to System > Network > Interface and select one or more interfaces for which to enable the explicit web proxy. Edit the interface configuration and select Enable Explicit FTP Proxy.
4 Go to Policy > Policy > Policy and select Create New and set the Source Interface/Zone to ftp-proxy.
You can add multiple ftp-proxy security policies.
5 Configure the security policy as required to accept the traffic that you want to be processed by the explicit web proxy.
The source address of the policy should match client source IP addresses. The firewall address selected as the source address cannot be assigned to a FortiGate interface. The Interface field of the firewall address must be blank or it must be set to Any.
The destination address of the policy should match the IP addresses of FTP servers that clients are connecting to. The destination address could be all to allow
connections to any FTP server.
If Default Firewall Policy Action is set to Deny, traffic sent to the explicit FTP proxy that is not accepted by an ftp-proxy security policy is dropped. If Default Firewall Policy Action is set to Allow then all web-proxy sessions that don’t match with a security policy are allowed.
For example the following security policy allows users on an internal network to access FTP servers on the Internet through the wan1 interface of a FortiGate unit.
6 You can select other security policy options as required.
For example, you can apply UTM protection to web proxy sessions and log allowed ftp proxy traffic.
7 You can also select Enable Identity Based Policy to apply authentication to explicit web proxy sessions.
To add identity based policies you must first add user groups to the FortiGate authentication configuration.
Enabling the explicit FTP proxy on an interface connected to the Internet is a security risk because anyone on the Internet who finds the proxy could use it to hide their source address. If you enable the proxy on such an interface make sure authentication is required to use the proxy.
Source Interface/Zone ftp-proxy Source Address Internal_subnet Destination
Interface/Zone
wan1 Destination Address all
Action ACCEPT
Explicit FTP proxy configuration overview The FortiGate explicit FTP proxy
8 You can add multiple identity based policies to apply different authentication for different user groups and also apply different UTM and logging settings for different user groups.
To enable the explicit web proxy - CLI
1 Enter the following command to turn on the explicit FTP proxy. This command also changes the explicit FTP proxy port to 2121.
config ftp-proxy explicit set status enable
set incoming-port 2121 end
The default explicit FTP proxy configuration has sec-default-action set to deny and requires you to add a security policy to allow access to the explicit FTP proxy.
1 Enter the following command to enable the explicit FTP proxy for the internal interface.
2 Use the following command to add a firewall address that matches the source address of users who connect to the explicit FTP proxy.
config firewall address
The source address for a ftp-proxy security policy cannot be assigned to a FortiGate unit interface.
3 Use the following command to add a security policy that allows all users on the 10.31.101.0 subnet to use the explicit web proxy for connections through the wan1 interface to the Internet.
The FortiGate explicit FTP proxy UTM features and the explicit FTP proxy
end end
The firewall address selected as the source address cannot be assigned to a FortiGate unit interface. Either the field must be blank or it must be set to Any.