Mark,
Sorry for the delay. The 'S' & 'D' should be replaced by the
port and server. Since your most likely doing NAT(RFC1918
addressing), I'm not quite sure what should be put here. I
would _assume_ that the NAT rules would take care of it.
Are you doing static or hide NAT? I think that hide NAT
will also do port translation, which may cause some
headaches - but again, I'm not positive.
Robert
- -
Robert P. MacDonald, Network Engineer
e-Business Infrastructure
G o r d o n F o o d S e r v i c e
Voice: +1.616.261.7987 email: [EMAIL PROTECTED]
>>> "Mark van Gelder" <[EMAIL PROTECTED]> 6/13/00 10:12:11 AM >>>
>Hi
>
>This is a Ver 4.0 SP6 installation.
>
>I currently have it set up with the service defined as type other, with a
>match field of "tcp, dport=7270"
>
>The base.def mods are as follows:
>
>set sr10 D, dst = S or set sr10 20, \
>record <src,port,dst,sr10,ip_p; ... > in connections \
>FTP_TRACK_DATA_CONN (port, sr10, TCP_TIMEOUT)
>
>I am not sure if the D and S should remain as D and S, or should become the
>server ip address (172.17.1.10) and destination port (7270).
> "You will need to add a check for a connection to server S so that
>FireWall-1 can allow the connection to port D (the data port). To do this,
>change the lines so they read:"
>I am also not sure that data port above is data port, or destination port.
>
>The "FTP Server" we are trying to connect to accepts FTP connections on Port
>7270.
>
>When you then try and transfer a file, it responds on an apparently random
>high port (this is actually the client src port +1). This is what was
>failing wen trying the information above.
>
>Thanks
>Mark
>
>
>-----Original Message-----
>From: Robert MacDonald [mailto:[EMAIL PROTECTED]]
>Sent: Tuesday, June 13, 2000 3:17 PM
>To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
>Subject: Re: [FW1] FTP of different ports
>
>
>Mark,
>
>Can you supply us with a little more info? What FW
>ver(appears to be v4.0? What service pack?
>What does your log say is happening? PASV?
>
>Based on your stated confusion with Dameon's
>documentation, did you add the actual port
>number, or did you enter 'desired_port'?
>
>Robert
>
>- -
>Robert P. MacDonald, Network Engineer
>e-Business Infrastructure
>G o r d o n F o o d S e r v i c e
>Voice: +1.616.261.7987 email: [EMAIL PROTECTED]
>
>>>> "Mark van Gelder" <[EMAIL PROTECTED]> 6/13/00 7:36:40 AM >>>
>>
>>Good Day
>>
>>I am trying to allow outbound FTP on one of our FW-1 modules on port 7270.
>>This is required as part of an existing interbank data transfer (so I have
>>not control over the port).
>>
>>I have followed the advice on Phoneboys site, but still cannot get the
>>connection to work. It appears that the data connection is being rejected.
>>
>>Has anyone got this working, and if so can you share what you had to do?
>>
>>The Phoneboy articly is a bit confusing, as it is not clear on whether the
>>"desired_port" should actually read "desired_port" or 7270, and the same
>>goes for the inspect code changes for base.def.
>>
>>I look forward to any help.
>>
>>Thanks
>>mark
>
>
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
