Applies To:

Show Versions Show Versions

Manual Chapter: Configuring Security for FTP Traffic
Manual Chapter
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

When you configure the FTP security profile, the BIG-IP® Protocol Security Module inspects FTP traffic for network vulnerabilities. To activate security checks for FTP traffic, you enable FTP security for an FTP service profile, and associate the service profile with a virtual server.
You can configure the Protocol Security Module to generate alarms or block requests for violations that trigger the following FTP security risks:
There are two methods for configuring security for FTP traffic: use the default system configuration, or create new configuration objects as required by your environment. For information on using the default system configuration, refer to Configuring FTP security using the default system configuration. For information on creating new configuration objects, refer to Configuring FTP security using new configuration objects.
The easiest method for initiating FTP protocol security for your FTP virtual server traffic is to use the system default settings. You do this by enabling protocol security for the system-supplied FTP service profile, and then associating that service profile with either a new or existing virtual server.
When you enable the Protocol Security setting for the system-supplied FTP profile, the system automatically associates the default FTP security profile (in the Protocol Security Module configuration) with this service profile.
1.
On the Main tab of the navigation pane, expand Local Traffic, and then click Profiles.
The HTTP Profiles screen opens.
2.
From the Services menu, choose FTP.
The FTP Profiles screen opens.
3.
In the Name column, click ftp.
The Properties screen for the system-supplied FTP profile opens.
4.
Clear the Translate Extended check box to disable IPv6 translation.
5.
Leave the Data Port setting at the default setting, 20.
6.
Check the Protocol Security check box to enable FTP security checks.
7.
Click the Update button to save any changes you have made.
Once you have enabled protocol security, you can associate the FTP service profile either with an existing virtual server or a new virtual server. Refer to Configuring an FTP virtual server, for more information.
If the default system configuration does not meet the requirements of your environment, you can create additional objects for FTP security and traffic management, as required.
FTP service profiles optimize FTP traffic in the LAN. The FTP service profile uses the FTP security profile to scan for vulnerabilities specific to the protocol.
Note: For more information about service profiles in general, refer to the chapter, Understanding Profiles, in the Configuration Guide for BIG-IP® Local Traffic Management. For information specific to the FTP service profile, refer to Configuring FTP profile settings, in the chapter, Managing Application Layer Traffic, in the same guide.
1.
On the Main tab of the navigation pane, expand Local Traffic, and then click Profiles.
The HTTP Profiles screen opens.
2.
From the Services menu, choose FTP.
The FTP Profiles screen opens.
3.
Above the list area, click the Create button.
The New FTP Profile screen opens.
4.
In the General Properties area, for the Name setting, type a unique name for the profile.
5.
For the Parent Profile setting, select the existing FTP profile from which you want the new profile to inherit settings. The default setting is ftp.
6.
Above the Settings area, check the Custom check box.
The system activates the editing mode for the individual settings.
7.
Clear the Translate Extended check box to disable IPv6 translation.
8.
Leave the Data Port setting at the default setting, 20.
9.
Check the Protocol Security check box to enable FTP security.
10.
Click Finished.
The screen refreshes and displays the new FTP service profile in the list.
The FTP security profile provides the security checks that are applicable to the FTP protocol. In the security profile, you also specify whether the Protocol Security Module logs violations locally (the default) or to a remote logging server. For more information, refer to Configuring remote logging.
1.
On the Main tab of the navigation pane, in the Protocol Security section, click Security Profiles.
The HTTP Security Profiles screen opens in a new browser session.
2.
From the Security Profiles menu, choose FTP.
The FTP Security Profiles screen opens.
3.
Above the FTP Security Profiles area, click the Create button.
The New Security Profile screen opens.
4.
In the Profile Properties area, in the Profile Name box, type a unique name for the profile.
5.
For the Remote Logging setting, check the box to enable remote logging for this security profile. This is an optional setting.
6.
In the Defense Configuration area, you can modify the blocking policy settings for the security profile violations. If you do not check either Alarm or Block for a violation, the system does not perform the corresponding security check.
Check Alarm if you want the system to log any requests that trigger the security profile violation.
Check Block if you want the system to block requests that trigger the security profile violation.
Check both Alarm and Block if you want the system to perform both actions.
Tip: See FTP security violations, for an explanation of the individual violations.
7.
Click Create.
The screen refreshes, and you see the new security profile in the list.
When you enable the Protocol Security setting on an FTP service profile, the system automatically assigns the first-listed FTP security profile to the FTP service profile. If you have more than one security profile configured, you can change the associations on the Profiles Assignment screen in the Protocol Security Module. On the Profiles Assignment screen, you can review the current associations, including the FTP service profile, the virtual server that uses the service profile, and the FTP security profile.
1.
On the Main tab of the Protocol Security navigation pane, click Profiles Assignment.
The Profile Assignment screen opens.
3.
In the FTP Security Profiles Assignment area, in the Assigned Security Profile column, for each service profile select the FTP security profile that you want the service profile to use.
4.
Click Save to retain any changes you may have made.
Note: If you have not yet created a virtual server that uses the FTP service profile, you do not see any virtual servers in the list.
You configure a local traffic virtual server and a default pool for the FTP servers, and associate the FTP service profile that you created. This automatically associates the FTP security profile with the virtual server. The result is that when the virtual server receives FTP traffic, the FTP security profile in the Protocol Security Module scans the FTP traffic for security vulnerabilities, and then the local traffic virtual server load balances any traffic that passes the scan.
Note: For more information about service profiles in general, refer to the chapter, Configuring Virtual Servers, in the Configuration Guide for BIG-IP® Local Traffic Management.
1.
On the Main tab of the navigation pane, expand Local Traffic, and then click Virtual Servers.
The Virtual Servers screen opens.
2.
Above the list, click the Create button.
The New Virtual Server screen opens.
3.
In the General Properties area, for the Name setting, type a unique name for the virtual server.
4.
For the Destination setting, select the type, and type an address, or an address and mask, as appropriate for your network.
5.
For the Service Port setting, either type 21 in the box, or select FTP from the list.
6.
Above the Configuration area, select Advanced.
The screen refreshes, and displays additional configuration options.
7.
For the FTP Profile setting, select either the system-supplied profile (ftp), or the profile that you created.
8.
For the SNAT Pool setting, if your network configuration requires address translation, select Auto Map.
9.
In the Resources area, for the Default Pool setting, click the Create (+) button.
The New Pool screen opens.
10.
On the New Pool screen, in the Configuration area, for the Name setting, type a unique name for the pool.
11.
On the New Pool screen, in the Resources area, for the New Members setting, you can add members to the pool by typing the IP addresses and ports, or by selecting addresses from a list.
Select New Address to type the address and port of any FTP servers that you want to add to the configuration. (Note that the system automatically adds them as nodes, too.)
Select Node List to select addresses from a list of servers that already exist in the local traffic configuration.
12.
On the New Pool screen, for the Service Port setting, select FTP from the list.
13.
Click the Add button to add each node or address to the New Members list.
14.
Click Finished.
The screen refreshes, and returns you to the New Virtual Server screen. The new pool should be listed in the Default Pool setting.
15.
Click Finished on the New Virtual Server screen.
The screen refreshes, and you see the new virtual server in the list.
The system is now ready to scan FTP traffic for vulnerabilities common to that protocol. See Reviewing violations statistics for security profiles, for information on reviewing the FTP security attacks that the system detects.
The Protocol Security Module provides statistics and transaction information about FTP traffic that triggers FTP security violations. If you have enabled the Alarm flag for a violation, and incoming FTP traffic triggers the violation, the Protocol Security Module logs the request, which you can review from the Statistics screen of the Protocol Security Module. If you have enabled the Block flag for any of the FTP security violations, the Protocol Security Module blocks the request.
Important: The Protocol Security Module stores FTP security violations in the system memory rather than on the hard disk. As a result, if you are using a redundant system, the violations data does not replicate to the other unit when you perform the ConfigSync operation.
1.
2.
If the system has detected a violation, then the violation name becomes a hyperlink. Click the link to see details about the offending requests.
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)