Problems with FTP over HTTP using CONNECT method

[User27408741]

Hello, We have issues with FTP over HTTP using Connect method (this is e.g. when we use filezilla or winscp with http proxy enabled). When we use browser to connect to FTP it works. It forms request in following fasthion GET ftp://ftp.redhat.com. When we use winscp or filezilla request arrives as CONNECT https://ftp.redhat.com. Problem is that connection fails if proxy attempts to SSL Scan this connection as it is connect. When we turn off SSL it works. Problem is that we have issue with creating exception for these FTP connections over HTTP with connect. when we used parameters like URL.protocol=FTP connection.protocol.FTP it doesnt match this traffic. We tried "command.name=CONNECT & URL.port=21" but this also didn't help us as after initial request on port 21 there are random high ports which will be scanned anyway and it still result in fail. Can you help us how to make FTP over HTTP using CONNECT method work? Thank you,

[asabban]

Hi,

this might become difficult, I don't think there is any relation between the control connection on port 21 and the high port data connection.

Do you have a way to create some rule engine trace or similar of the data connection so I can take a look if there is a way to create a generic whitelist approach?

Andre

[User27408741]

Hello Andre,

Thanks for replying to me. Attached are rule traces from one attempt as requested. Currently we have destinations in SSL whitelist. But we are still looking for general rule to avoid administrative work for every new connection as previously we used Symantec SGs where it was possible. Thanks,

[asabban · Accepted solution]

Hello,

thank you for the rule trace. As mentioned it is hard to make a useful rule. My idea would be to do a rule:

Request.Header.Get("User-Agent") matches FileZilla/*

AND

URL.Port > 1024

to bypass SSL inspection for these requests. Along with some URL Filtering rules that make sure category and reputation are good you should have some protection left.

It might be better to take a look if it is possible to re-configure File Zilla to use MWGs FTP Proxy to allow it to inspect the traffic.

Andre

[User27408741]

Hi Andre,

Thank you for analysis and input. If there is no single parameter to cover it I guess we will just have to play with it a bit to cover as much as possible while not affecting other services. Thank you,