Chapter 21: Ftp Proxy - Tavve zoneranger User Manual

Chapter 21: FTP Proxy

The basic intent of the FTP protocol is to allow client applications to transfer files to/from a remote
server. The FTP protocol is based on TCP and separates control and data into separate TCP connections.
In cases where the client and server are separated by a firewall, this separation of control and data
connections creates a problem. While control connections are always directed at a well-known port, data
connections use dynamically assigned ports, making it difficult to configure the firewall to allow only
the needed ports. Making matters worse, the direction in which the data connection is initiated depends
on whether requested transfer mode is active or passive, making it difficult to implement a policy
preventing initiation of connections from less secure network zones to more secure network zones.
The ZoneRanger FTP proxy service provides an effective solution for these problems, acting as an
application-layer proxy firewall for FTP traffic, enabling FTP clients to exchange files with servers
located within firewall-partitioned networks.
The following figure provides a high-level overview of an FTP proxy transaction. Note that the
Management Application Server in this figure is acting as an FTP client, and one or more managed
devices may act as FTP servers.
Figure 21-1. ZoneRanger FTP Proxy
Note that the put file or get file requests and associated responses shown in this figure are exchanged via
the control connection, while the transfer of the actual file content takes place over a separate TCP data
connection. The ZoneRanger FTP proxy service carefully inspects all FTP control connection traffic,
and only those data connections that are matched with known outstanding transfer requests, are allowed
to pass.
The ZoneRanger FTP proxy feature supports all FTP protocol transactions defined in RFC 959,
including:
•
Get File Request (from devices in a firewall-partitioned zone)
•
Put File Request (to devices in a firewall-partitioned zone)
•
List Directory Request
•
Delete File Request
•
Rename File Request
ZoneRanger 5.5 User's Guide 65