- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
DPI-SSL, FTPS (FTP over SSL/TLS) and GAV
03/26/2020 
344 People found this article helpful
44,216 Views
Description
In FTPS, traffic passing through SonicWall will be encrypted and therefore cannot be inspected for malware. For this purpose DPI-SSL can be implemented to enable SonicWall to inspect such traffic in clear text and enforce Security Services.
This article lists the steps required to configure DPI-SSL to inspect FTPS traffic and enforce Gateway Anti-virus (GAV) on such traffic.
Resolution
When clients behind the SonicWall access an FTPS server on the WAN side of the SonicWall and outbound FTPS connection needs to be decrypted.
In this example, we use the default SonicWall DPI-SSL CA certificate.
- In the SonicWall management GUI, navigate to the DPI-SSL | Client DPI-SSL page.
- Enable check box Enable SSL Client Inspection.
- Enable check box Gateway Anti-virus (GAV).
- Click on Accept at the top to save the changes.
Other options like including or excluding users, IP addresses are not enabled in this example but can be enabled as per the deployment. Although none of the Security Services except GAV are enabled, all traffic with standard SSL ports as destination will be re-signed by Client DPI-SSL .
Step 3. Configure Server DPI-SSL
When the FTPS server is behind the SonicWall and clients connect to it from the WAN side of the SonicWall. Before configuring Server DPI-SSL we must import a server certificate into the SonicWall. Although the server certificate could be either from a Windows CA or from a public CA like GoDaddy, it is recommended to use a certificate signed by a public CA. Please refer to these articles on how to obtain a server certificate:
- How do I install a GoDaddy certificate on a SonicWall?
- UTM: How to Request and Import a Signed Certificate from Thawte
- UTM: How to obtain a Certificate from a Windows Certificate Authority (CA)
Once the certificate is imported into the SonicWall it must be mapped to the private IP address of the FTPS server.
- Navigate to the DPI-SSL | Server DPI-SSL page.
- Enable check box Enable SSL Server Inspection.
- Click on Add under SSL Servers to open the Server DPI-SSL - Add Server window.
- Select the address object of your FTP server's private IP address under Address Object/Group.
- Under SSL Certificate select the server certificate imported earlier into the SonicWall.
- Leave the Clear Text check box unchecked.
Step 4. Configure Gateway Anti-Virus
- Navigate to Security Services | Gateway Anti-Virus page.
- Enable check box Enable Gateway Anti-Virus.
- Enable check boxes under TCP Stream | Enable Inbound and Outbound Inspection. When FTPS traffic is decrypted by the SonicWall, it is not considered as FTP data but as decrypted TCP stream.
- Click Accept to save the settings.
FTP Settings under Protocols need not be checked because the following options will not be enforced:
- Restrict Transfer of password-protected ZIP files
- Restrict Transfer of MS-Office type files containing macros (VBA 5 and above)
- Restrict Transfer of packed executable files (UPX, FSG, etc.)
Related Articles
- Supported Public Cloud Servers/Instance Sizes on SonicWall NSv Series Models
- Why do I need a Support Services Reinstatement?
- How can I configure a VPN between a SonicWall firewall and Microsoft Azure?
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO