Configuring the explicit FTP proxy - web‑based manager
Use the following steps to configure the explicit FTP proxy from FortiGate web‑based manager.
To enable and configure the explicit FTP proxy
1. Go to System > Network > Explicit Proxy > Explicit FTP Proxy Options and change the following settings:
Enable Explicit FTP Proxy | Select. |
Listen on Interface | No change. This field will eventually show that the explicit web proxy is enabled for the Internal interface. |
FTP Port | 2121 |
Default Firewall Policy Action | Deny |
2. Select Apply.
To enable the explicit FTP proxy on the Internal interface
1. Go to System > Network > Interface, edit the Internal interface and select Enable Explicit FTP Proxy.
To add a RADIUS server and user group for the explicit FTP proxy
1. Go to User & Device > Authentication > RADIUS Servers.
2. Select Create New to add a new RADIUS server:
Name | RADIUS_1 |
Primary Server Name/IP | 10.31.101.200 |
Primary Server Secret | RADIUS_server_secret |
3. Go to User > User > User Groups and select Create New.
Name | Explict_proxy_user_group |
Type | Firewall |
Remote groups | RADIUS_1 |
Group Name | ANY |
4. Select OK.
To add a security policy for the explicit FTP proxy
1. Go to Policy &Objects > Objects > Addresses and select Create New.
2. Add a firewall address for the internal network:
Address Name | Internal_subnet |
Type | Subnet |
Subnet / IP Range | 10.31.101.0 |
Interface | Any |
3. Go to Policy & Objects > Policy > Explicit Proxy and select Create New.
4. Configure the explicit FTP proxy security policy.
Explicit Proxy Type | FTP |
Source Address | Internal_subnet |
Outgoing Interface | wan1 |
Destination Address | all |
Action | AUTHENTICATE |
5. Under Configure Authentication Rules select Create New to add an authentication rule:
Groups | Explicit_policy |
Users | Leave blank |
Schedule | always |
6. Turn on Antivirus and Web Filter and select the default profiles for both.
7. Select the default proxy options profile.
8. Select OK.
9. Make sure Enable IP Based Authentication is not selected and Default Authentication Method is set to Basic.
10. Select OK.