Figure 6.3. FTP ALG Hybrid Mode
Note: Hybrid conversion is automatic
Hybrid mode does not need to enabled. The conversion between modes occurs
automatically within the FTP ALG.
Connection Restriction Options
The FTP ALG has two options to restrict which type of mode the FTP client and the FTP server can
use:
•
Allow the client to use active mode.
If this is enabled, FTP clients are allowed to use both passive and active transfer modes. With
this option disabled, the client is limited to using passive mode. If the FTP server requires active
mode, the NetDefendOS FTP ALG will handle the conversion automatically to active mode.
A range of client data ports is specified with this option. The server will be allowed to connect to
any of these if the client is using active mode. The default range is 1024-65535.
•
Allow the server to use passive mode.
If this option is enabled, the FTP server is allowed to use both passive and active transfer modes.
With the option disabled, the server will never receive passive mode data channels.
NetDefendOS will handle the conversion automatically if clients use passive mode.
A range of server data ports is specified with this option. The client will be allowed to connect to
any of these if the server is using passive mode. The default range is 1024-65535.
These options can determine if hybrid mode is required to complete the connection. For example, if
the client connects with passive mode but this is not allowed to the server then hybrid mode is
automatically used and the FTP ALG performs the conversion between the two modes.
Predefined FTP ALGs
NetDefendOS provides four predefined FTP ALG definitions, each with a different combination of
the client/server mode restrictions described above.
•
ftp-inbound - Clients can use any mode but servers cannot use passive mode.
•
ftp-outbound - Clients cannot use active mode but servers can use any mode.
•
ftp-passthrough - Both the client and the server can use any mode.
•
ftp-internal - The client cannot use active mode and the server cannot use passive mode.
FTP ALG Command Restrictions
The FTP protocol consists of a set of standard commands that are sent between server and client. If
the NetDefendOS FTP ALG sees a command it does not recognize then the command is blocked.
This blocking must be explicitly lifted and the options for lifting blocking are:
•
Allow unknown FTP commands. These are commands the ALG does not consider part of the
6.2.3. The FTP ALG
Chapter 6. Security Mechanisms
278
Summary of Contents for NetDefend DFL-1660
Page 28: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 28 ...
Page 88: ...2 6 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 88 ...
Page 166: ...3 10 DNS Chapter 3 Fundamentals 166 ...
Page 254: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 254 ...
Page 268: ...5 4 IP Pools Chapter 5 DHCP Services 268 ...
Page 368: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 368 ...
Page 390: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 390 ...
Page 414: ...8 3 Customizing Authentication HTML Pages Chapter 8 User Authentication 414 ...
Page 490: ...9 8 6 Specific Symptoms Chapter 9 VPN 490 ...
Page 528: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 528 ...
Page 544: ...11 7 HA Advanced Settings Chapter 11 High Availability 544 ...
Page 551: ...12 3 5 Limitations Chapter 12 ZoneDefense 551 ...
Page 574: ...Default 512 13 9 Miscellaneous Settings Chapter 13 Advanced Settings 574 ...
Page 575: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 575 ...