FTP Dropped by Fireweall

[Andrew Pollard]

Hi,

Regularly we receive ftp's from different servers outside the firewall and the ftp sessions are successful, but once in a while the ftp is considered to be an attack and is dropped.

The Firewall type is:
Checkpoint Firewall-1 NGX R62

The firewall error is:
Product: SmartDefense
Action: Reject
Service: ftp-basic (21)
Protocol: tcp
Source Port: 41697
Attack Name: FTP Bounce
Attack Information: Port/227 command missing a newline character

This problem is happening between different server models and HPUX OS vesions.

Does anyone have any ideas what the cause might be?

Thanks

Andrew

[Steven E. Protter · Accepted solution]

Shalom,

Something about the client is triggering Checkpoint to think this is an attack.

The only way to get information on this is from checkpoint or perhaps a checkpoint firewall admin here. This isn't really an HP-UX admin question.

I'm, guessing the source or destination port is triggering it.

SEP

[Andrew Pollard]

Hi Steven,

Thanks for the info, I will pass it along.

Andrew