NSE4 · Question #279
An administrator sets up a new FTP server on TCP port 2121. A FortiGate unit is located between the FTP clients and the server. The administrator has created a policy for TCP port 2121. Users have…
The correct answer is A. Create a new session helper for the FTP service monitoring port 2121. To resolve FTP data connection issues when the server uses a non-standard port like 2121, a FortiGate session helper (ALG) must be configured for the FTP service on that specific port.
Question
An administrator sets up a new FTP server on TCP port 2121. A FortiGate unit is located between the FTP clients and the server. The administrator has created a policy for TCP port 2121. Users have been complaining that when downloading data they receive a 200 Port command successful message followed by a 425 Cannot build data connection message. Which of the following statements represents the best solution to this problem?
Options
- ACreate a new session helper for the FTP service monitoring port 2121.
- BEnable the ANY service in the firewall policies for both incoming and outgoing traffic.
- CPlace the client and server interface in the same zone and enable intra-zone traffic.
- DDisable any protection profiles being applied to FTP traffic.
How the community answered
(59 responses)- A81% (48)
- B5% (3)
- C3% (2)
- D10% (6)
Why each option
To resolve FTP data connection issues when the server uses a non-standard port like 2121, a FortiGate session helper (ALG) must be configured for the FTP service on that specific port.
FTP uses separate control and data connections; when the control channel operates on a non-standard port (2121), the FortiGate's NAT and firewall may not correctly inspect the control traffic to dynamically open the necessary data ports. A session helper (or Application Layer Gateway - ALG) for FTP configured for port 2121 is essential to correctly parse the FTP commands (like PASV/PORT) and open the corresponding data channels through the firewall.
Enabling the 'ANY' service in firewall policies is a significant security risk and does not specifically address the protocol-aware NAT/firewall processing required for FTP on a non-standard port.
Placing clients and servers in the same zone and enabling intra-zone traffic bypasses security policies and is not a suitable solution for a firewall-related protocol issue.
Disabling protection profiles removes valuable security layers and will not resolve the underlying issue of the FortiGate failing to properly handle the FTP protocol's data channel negotiation on a non-standard port.
Concept tested: FortiGate FTP ALG/session helper for non-standard ports
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/469279/application-layer-gateways
Topics
Community Discussion
No community discussion yet for this question.