Solved

Symantec Enterprise Firewall

Posted on 2004-10-15
2
218 Views
Last Modified: 2013-11-16
We have a Symantec Enterprise Firewall (v7.0.4) and would like to put an FTP server using SafeTP in our DMZ. On the SafeTP firewall setup page (http://safetp.cs.berkeley.edu/firewall.html) it says to "Configure the firewall so that incoming connections to ports (say) 40000-40999 are forwarded to the sftpd server (at the same port as the connection requested)." How do I go about doing this? Thanks!
0
Comment
Question by:MichaelHSmith
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 1

Accepted Solution

by:
mxp1l0t earned 125 total points
ID: 12359229
You shouldn't need to open up those ports inbound to support PASV transfers with the SEF firewall.  When you specify the ftp application proxy in the inbound rule, the firewall keeps track of the ftp communication and will allow the communication on any port > 1024.

In brief you will need to create 2 network entities.  1 for the DMZ address and 1 for the outside address.
1 redirected service for ftp
1 rule allowing the traffic inbound
0
 

Author Comment

by:MichaelHSmith
ID: 12870518
Thanks.
0

Featured Post

Get Actionable Data from Your Monitoring Solution

Your communication platform is only as good as the relevance of the information you send. Ensure your alerts get to the right people every time with actionable responses. Create escalation rules that ensure everyone follows the process and nothing is left to chance.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question