The Log Shows FTP: PASV response bounce attack dropped

03/26/2020 55 16109

DESCRIPTION:
The Log Shows FTP: PASV response bounce attack dropped

RESOLUTION:

The SonicWall appliance has detected and blocked a possible PASV (passive) response bounce denial of service attack. FTP PASV response packets can be spoofed to allow an attacker to establish arbitrary TCP connections to FTP servers or clients located behind some firewalls.

The following represents an explanation of how we handle FTP traffic:

If FTP Bounce protection is on, and we see a PORT command, and the IP address specified in the PORT command is different from the source of the command or the port number is less than or equal to 1024, then we consider it a bounce attack and drop it. Legitimate clients should never use an IP other than their own, and should not be using ports <= 1024. And well behaved servers should ignore ports <= 1024, too, as described in RFC 2577.

For Passive FTP connections, when a client sends a PASV command, the server responds with a Passive IP address and port number. The SonicWall expects the server to send its internal private IP address in its response to the PASV command and then transforms the private IP to the WAN IP address of the SonicWall.

If legitimate FTP sessions are being blocked, follow these guidelines:

• Make sure the IP address supplied to clients by the FTP server in its response to the PASV command is the same as the server's internal, private IP address. This address should represent the server's internal LAN private IP. Check the configuration of the FTP server software and the implementation of network address translation (NAT) on the firewall or router in front of the server.
• If nonstandard ports are being used for the FTP session, ensure the port number is greater than 1024.

FTP bounce attack protection can be enabled or disabled in the Diag page of the SonicWall - http://<SonicWall Management IP address>/diag.html