General configuration steps
You can use the following general steps to configure the explicit FTP proxy.
To enable the explicit FTP proxy - web‑based manager
1. Go to System > Network > Explicit Proxy > Explicit FTP Proxy Options. Select Enable Explicit FTP Proxy to turn on the explicit FTP proxy.
2. Select Apply.
The default explicit FTP proxy configuration has Default Firewall Policy Action set to Deny and requires you to add a security policy to allow access to the explicit FTP proxy. This configuration is recommended and is a best practice because you can use security policies to control access to the explicit web proxy and also apply security features such as logging, security profiles, and authentication (by adding identity-based policies).
3. Go to System > Network > Interface and select one or more interfaces for which to enable the explicit web proxy. Edit the interface configuration and select Enable Explicit FTP Proxy.
| Enabling the explicit FTP proxy on an interface connected to the Internet is a security risk because anyone on the Internet who finds the proxy could use it to hide their source address. If you enable the proxy on such an interface make sure authentication is required to use the proxy. |
4. Go to Policy > Policy > Policy and select Create New and set the Source Interface/Zone to ftp-proxy.
You can add multiple ftp-proxy security policies.
5. Configure the security policy as required to accept the traffic that you want to be processed by the explicit web proxy.
The source address of the policy should match client source IP addresses. The firewall address selected as the source address cannot be assigned to a FortiGate interface. The Interface field of the firewall address must be blank or it must be set to Any.
The destination address of the policy should match the IP addresses of FTP servers that clients are connecting to. The destination address could be all to allow connections to any FTP server.
If Default Firewall Policy Action is set to Deny, traffic sent to the explicit FTP proxy that is not accepted by an ftp-proxy security policy is dropped. If Default Firewall Policy Action is set to Allow then all web-proxy sessions that don’t match with a security policy are allowed.
For example the following security policy allows users on an internal network to access FTP servers on the Internet through the wan1 interface of a FortiGate unit.
Policy Type | Firewall |
Policy Subtype | Address |
Incoming Interface | ftp-proxy |
Source Address | Internal_subnet |
Outgoing Interface | wan1 |
Destination Address | all |
Schedule | always |
Action | ACCEPT |
The following security policy requires users on an internal network to authenticate with the FortiGate unit before accessing FTP servers on the Internet through the wan1 interface.
Policy Type | Firewall |
Policy Subtype | User Identity |
Incoming Interface | ftp-proxy |
Source Address | Internal_subnet |
Outgoing Interface | wan1 |
Destination Address | all |
Select Create New to add an Authentication Rule and configure the rule as follows:
Groups | Proxy-Group |
Users | (optional) |
Schedule | always |
Action | ACCEPT |
Add security profiles as required and select OK.
You can add multiple user identity policies to apply different authentication for different user groups and users and also apply different security profiles and logging settings for different user groups.
6. You can select other security policy options as required.
For example, you can apply security profiles to web proxy sessions and log allowed ftp proxy traffic.
7. Select OK.
To enable the explicit web proxy - CLI
1. Enter the following command to turn on the explicit FTP proxy. This command also changes the explicit FTP proxy port to 2121.
config ftp-proxy explicit
set status enable
set incoming-port 2121
end
The default explicit FTP proxy configuration has sec-default-action set to deny and requires you to add a security policy to allow access to the explicit FTP proxy.
2. Enter the following command to enable the explicit FTP proxy for the internal interface.
config system interface
edit internal
set explicit-ftp-proxy enable
end
end
3. Use the following command to add a firewall address that matches the source address of users who connect to the explicit FTP proxy.
config firewall address
edit Internal_subnet
set type iprange
set start-ip 10.31.101.1
set end-ip 10.31.101.255
end
The source address for a ftp-proxy security policy cannot be assigned to a FortiGate unit interface.
4. Use the following command to add a security policy that allows all FTP proxy users on the 10.31.101.0 subnet to use the explicit FTP proxy for connections through the wan1 interface to the Internet. This policy also applies virus scanning to FTP proxy traffic.
config firewall policy
edit 2
set srcintf ftp-proxy
set dstintf wan1
set scraddr Internal_subnet
set dstaddr all
set action accept
set schedule always
set utm-status enable
set profile-protocol-options default
set av-profile default
end
The following command requires FTP proxy users to authenticate with the FortiGate unit before accessing FTP servers on the Internet.
config firewall policy
edit 2
set srcintf ftp-proxy
set dstintf wan1
set scraddr Internal_subnet
set dstaddr all
set action accept
set identity-based enable
config identity-based-policy
edit 1
set groups Internal_users
set schedule always
set utm-status enable
set profile-protocol-options default
set av-profile default
end
end