cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Problems with FTP over HTTP using CONNECT method

Jump to solution
Hello, We have issues with FTP over HTTP using Connect method (this is e.g. when we use filezilla or winscp with http proxy enabled). When we use browser to connect to FTP it works. It forms request in following fasthion GET ftp://ftp.redhat.com. When we use winscp or filezilla request arrives as CONNECT https://ftp.redhat.com. Problem is that connection fails if proxy attempts to SSL Scan this connection as it is connect. When we turn off SSL it works. Problem is that we have issue with creating exception for these FTP connections over HTTP with connect. when we used parameters like URL.protocol=FTP connection.protocol.FTP it doesnt match this traffic. We tried "command.name=CONNECT & URL.port=21" but this also didn't help us as after initial request on port 21 there are random high ports which will be scanned anyway and it still result in fail. Can you help us how to make FTP over HTTP using CONNECT method work? Thank you,
1 Solution

Accepted Solutions
asabban
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Problems with FTP over HTTP using CONNECT method

Jump to solution

Hello,

thank you for the rule trace. As mentioned it is hard to make a useful rule. My idea would be to do a rule:

Request.Header.Get("User-Agent") matches FileZilla/*

AND

URL.Port > 1024

to bypass SSL inspection for these requests. Along with some URL Filtering rules that make sure category and reputation are good you should have some protection left.

It might be better to take a look if it is possible to re-configure File Zilla to use MWGs FTP Proxy to allow it to inspect the traffic.

Andre

View solution in original post

4 Replies
asabban
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Problems with FTP over HTTP using CONNECT method

Jump to solution

Hi,

this might become difficult, I don't think there is any relation between the control connection on port 21 and the high port data connection.

Do you have a way to create some rule engine trace or similar of the data connection so I can take a look if there is a way to create a generic whitelist approach?

Andre

Re: Problems with FTP over HTTP using CONNECT method

Jump to solution

Hello Andre,

 

Thanks for replying to me. Attached are rule traces from one attempt as requested. Currently we have destinations in SSL whitelist. But we are still looking for general rule to avoid administrative work for every new connection as previously we used Symantec SGs where it was possible. Thanks,

asabban
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Problems with FTP over HTTP using CONNECT method

Jump to solution

Hello,

thank you for the rule trace. As mentioned it is hard to make a useful rule. My idea would be to do a rule:

Request.Header.Get("User-Agent") matches FileZilla/*

AND

URL.Port > 1024

to bypass SSL inspection for these requests. Along with some URL Filtering rules that make sure category and reputation are good you should have some protection left.

It might be better to take a look if it is possible to re-configure File Zilla to use MWGs FTP Proxy to allow it to inspect the traffic.

Andre

View solution in original post

Re: Problems with FTP over HTTP using CONNECT method

Jump to solution

Hi Andre,

Thank you for analysis and input. If there is no single parameter to cover it I guess we will just have to play with it a bit to cover as much as possible while not affecting other services. Thank you,

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community