Nokia IP60 - Security Appliance, User Manual

Page: 36 / 494

The Nokia IP60 Firewall
36 Nokia IP60 Security Appliance User Guide
Command connection from the client on a port greater than 1023, to the server on port 21
Data connection from the client on a port greater than 1023, to the server on a port greater than
1023
The fact that both of the channels are established by the client presents a challenge for the firewall
protecting the FTP server: while a firewall can easily be configured to identify incoming command
connections over the default port 21, it must also be able to handle incoming data connections over a
dynamic port that is negotiated randomly as part of the FTP client-server communication. The following
table examines how different firewall technologies handle this challenge:
Table 10: Firewall Technologies and Passive FTP Connections
Firewall Technology Action
Packet Filter Packet filters can handle outbound FTP connections in either of the
following ways:
By leaving the entire upper range of ports (greater
than 1023) open. While this allows the file transfer
session to take place over the dynamically allocated port,
it also exposes the internal network.
By shutting down the entire upper range of ports.
While this secures the internal network, it also blocks
other services.
Thus packet filters' handling of Passive FTP comes at the expense
of either application support or security.
Application-Layer
Gateway (Proxy)
Application-layer gateways use an FTP proxy that acts as a go-
between for all client-server sessions.
This approach overcomes the limitations of packet filtering by
bringing application-layer awareness to the decision process;
however, it also takes a high toll on performance. In addition, each
service requires its own proxy (an FTP proxy for FTP sessions, an
HTTP proxy for HTTP session, and so on), and since the
application-layer gateway can only support a certain number of
proxies, its usefulness and scalability is limited. Finally, this
approach exposes the operating system to external threats.