[Xitami] FTP and FW-1

[ian]

If you want to diagnose connection problems with your FTP server, you 
should be looking at your FW logs not the output of your FTP server. 
The logs will tell you more about what is going on and will show 
accepted and dropped packets.

FWIW: FW1 can handle passive connections just fine. Checkpoint has 
inspect code built in for the ftp service and can open the correct 
dynamic ports for each session.

There is a bug/limitation in earlier versions (even 4.1) of Checkpoint 
where the passive sessions for multiple files can eventually start 
running into the listed ports - then FW1 thinks that the dynamic port 
requests are invalid and will close the session. This only seems to 
happen with certain combinations of clients/servers and where they 
decide to start opening dynamic ports... just thought I would mention 
it, I don't use Xitami's ftp server, I got bit a long time ago by it 
and I have never forgiven it! I use ServU and have never had an issue 
and all my traffic goes through a Checkpoint FW.

More help for Checkpoint can be found either at their knowledge base or 
you can find a lot of great information at www.phoneboy.com

-Ian

-----Original Message-----
From: "Fabien Royer" <fabien_royer@hotmail.com>
To: xitami@lists.xitami.org
Date: Thu, 18 Jul 2002 13:03:21 -0400
Subject: Re: [Xitami] FTP and FW-1

> Greg,
> 
> Your data channel is never being established because FW-1 is not
> letting the 
> FTP server through to connect back to your client.
> 
> You can usually get around this problem by using your FTP client in
> passive 
> mode, where the client initiates both command and data channels with
> the FTP 
> server. However, this is going to require Firewall-1 to be configured
> to let 
> a range of ports open to the FTP server.
> 
> While this is not a problem with a NAT-ted setup, you may encounter 
> "political" management resistance ;-)
> 
> I hope this helps.
> 
> Regards,
> Fabien.
> 
> >From: Greg Blake <greg@healthgate.com>
> >Reply-To: xitami@lists.xitami.org
> >To: "'xitami@lists.xitami.org'" <xitami@lists.xitami.org>
> >Subject: [Xitami] FTP and FW-1
> >Date: Thu, 18 Jul 2002 12:08:18 -0400
> >
> >I'm trying to ftp to Xitami through a Firewall-1 box.  We're using
> NAT.
> >
> >When I connect It looks something like this:
> >230 User greg logged-in
> >Remote system type is Windows.
> >ftp> ls
> >
> >200 Command okay
> >200 Command okay
> >ftp>
> >
> >It appears that the data connection isn't being made correctly. 
> What is 
> >odd
> >is that if I set up IIS ftp everything works fine connecting through
> the
> >firewall.  I'm wondering if there is some configuration option in
> Xitami 
> >I'm
> >missing or something.
> >
> >Hoping this makes sense to someone...
> >gregory
> >
> >
> >--
> >Xitami Users Mailing List -- For Xitami support
> >To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> 
> 
> 
> 
> _________________________________________________________________
> MSN Photos is the easiest way to share and print your photos: 
> http://photos.msn.com/support/worldwide.aspx
> 
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami