SonicWall & FileZilla

[SeeCured]

Trying to create an FTP server for my SonicWall to dump packet capture information. I followed the information found in this SW article: https://www.sonicwall.com/support/knowl ... 5759948480. However, the logs won't send. The FZ server lives on the computer that the logs are being sent to,

Is there something I should be looking at to confirm that this works? When I first set it up, it worked and now it doesn't. I didn't make any changes to the config and have no idea why it stopped.

[botg]

That does it say in the server log?

[SeeCured]

It's worth noting that some time ago it did work, but now it doesn't.


A whole bunch of:

(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> Connected on port 21, sending welcome message...
(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> 220-FileZilla Server 0.9.60 beta
(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> 220-written by Tim Kosse (tim.kosse@filezilla-project.org)
(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> 220 Please visit https://filezilla-project.org/
(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> quit
(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> 221 Goodbye
(000687) 6/25/2019 0:03:13 AM - (not logged in) (127.0.0.1)> disconnected.
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> Connected on port 21, sending welcome message...
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> 220-FileZilla Server 0.9.60 beta
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> 220-written by Tim Kosse (tim.kosse@filezilla-project.org)
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> 220 Please visit https://filezilla-project.org/
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> quit
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> 221 Goodbye
(000688) 6/25/2019 0:04:20 AM - (not logged in) (127.0.0.1)> disconnected.
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> Connected on port 21, sending welcome message...
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> 220-FileZilla Server 0.9.60 beta
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> 220-written by Tim Kosse (tim.kosse@filezilla-project.org)
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> 220 Please visit https://filezilla-project.org/
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> quit
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> 221 Goodbye
(000689) 6/25/2019 0:05:26 AM - (not logged in) (127.0.0.1)> disconnected.


Instead of:

(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> 230 Logged on
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> TYPE I
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> 200 Type set to I
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> CWD captures
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> 250 CWD successful. "/captures" is current directory.
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> PORT 10,10,12,1,205,117
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> 200 Port command successful
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> STOR packet-log--2197- 5-02272019.cap
(003722) 2/27/2019 0:05:51 AM - firewall (10.10.12.1)> 150 Opening data channel for file upload to server of "/captures/packet-log--2197- 5-02272019.cap"
(003722) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 226 Successfully transferred "/captures/packet-log--2197- 5-02272019.cap"
(003722) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> QUIT
(003722) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 221 Goodbye
(003722) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> disconnected.
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> Connected on port 21, sending welcome message...
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> 220-FileZilla Server 0.9.60 beta
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> 220-written by Tim Kosse (tim.kosse@filezilla-project.org)
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> 220 Please visit https://filezilla-project.org/
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> USER firewall
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> 331 Password required for firewall
(003723) 2/27/2019 0:05:59 AM - (not logged in) (10.10.12.1)> PASS ************
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 230 Logged on
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> TYPE I
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 200 Type set to I
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> CWD captures
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 250 CWD successful. "/captures" is current directory.
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> PORT 10,10,12,1,205,119
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 200 Port command successful
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> STOR packet-log_h-2197- 5-02272019.html
(003723) 2/27/2019 0:05:59 AM - firewall (10.10.12.1)> 150 Opening data channel for file upload to server of "/captures/packet-log_h-2197- 5-02272019.html"
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> Connected on port 21, sending welcome message...
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> 220-FileZilla Server 0.9.60 beta
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> 220-written by Tim Kosse (tim.kosse@filezilla-project.org)
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> 220 Please visit https://filezilla-project.org/
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> quit
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> 221 Goodbye
(003724) 2/27/2019 0:06:05 AM - (not logged in) (127.0.0.1)> disconnected.

[botg]

That's a client-side problem.

The client connects and the first thing it does is to send the quit command in an unorthodox way (commands are supposed to be in uppercase) to quit.

[SeeCured]

That's a client-side problem.

The client connects and the first thing it does is to send the quit command in an unorthodox way (commands are supposed to be in uppercase) to quit.

I concur. I was able to create a connection to FileZilla server using Windows Explorer and it works just fine. Therefore the problem has to be with how SonicWall handles FTP. Although from the time it worked until yesterday no configuration changes were made to the firewall or the FZ server. However, I did update the firewall firmware last night. I'm really confused.

[boco]

That' one for their support. FileZilla Server does what it is commanded to do.