IT Employment

Ask something
Discussion Locked

WSFTP Server Issue

0 helpful
3 replies

by jhaley

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have installed a WSFTP (V 3.1) Server, on a Windows 2000 Server, for the purpose of running SFTP for receipt of customer files. The server was placed on our DMZ (Cisco 515E Pix). Access is via the internet to a public address with a NAT to a private address on the DMZ. The error we receive is "425 Can't connect to connection". The basic problem is that connectivity to the FTP Server supporting SSL across a NAT'd public address doesn't work well or not at all. Now looking at the WSFTP supportdocuments you gather this is a known problem and their programming staff doesn't have a fix. Of course we purchased the product w/o doing any research. Since we exclusively use the WSFTP Client we felt it would be a good fit.
As a possible solution we are considering placing the server on another public address, add a second DMZ Card to the pix,and use a static address. Of course, doing so opens up a security hole. We could place the server outside the firewall.

Perhaps someone has encountered this exact issue.
Any recommendations/solutions would be appreciated.

Thanks!

3 replies

by dukebytes

Use the static address. You can't really do it any other way.

I have a WSFTP server in the DMZ and have only the ports needed to get to it open in the firewall.

If the only thing that you are going to do with it is SFTP - just open those ports and nothing else. If you have an inside, a DMZ and an outside interface I can't see how that would be a security hole by placing the FTP server in the DMZ with a static address???

If you place the server outside the firewall - it would 100 times more hackable and not last very long.

Lose the NAT - give it a static and leave it in the DMZ where it is protected. This is the way we have it and haven't had an ounce of trouble with it.

Good luck,
Duke

by jhaley

Duke,

I've four FTP servers on A NAT from an outside to inside server. If I configured a WSFTP server on a separate outside to inside interface and did away with NAT how would setup the static?

by dukebytes

The static would look something like this.

static (inside, outside) 200.200.200.200 10.10.10.10 netmask 255.255.255.255 200 400

the 200.x.x.x address is one of your "real" outside addresses and the 10.x.x.x is the actual address of the WSFTP server.

This will "give" it a real address that will be constant for users to get into.

Good luck,
Duke

This discussion is closed to new replies.