Manual Chapter :
Securing FTP Traffic Using the Default Configuration
Applies To:
Show Versions
BIG-IP ASM
- 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
Securing FTP Traffic Using the Default Configuration
Overview: Securing FTP traffic using default values
This implementation describes how to secure FTP traffic the easy way--by using default values. When you use an FTP security profile, the BIG-IP® system inspects FTP traffic for network vulnerabilities. A default FTP security profile is included in the system that you can use. To activate security checks for FTP traffic, you enable protocol security in an FTP service profile, and associate the service profile with a virtual server.
You can use the default configuration to protect against the following FTP security risks:
- Port scanning exploits
- Anonymous FTP requests
- Command line length exceeds the defined length
- Potentially dangerous FTP commands
- Traffic that fails FTP protocol compliance checks
- Brute force attacks (due to excessive FTP login attempts)
- File stealing exploits
Task summary
Creating an FTP service profile with security enabled
The easiest method for initiating FTP protocol security for your FTP virtual server
traffic is to use the system default settings. You do this by enabling protocol security
for the system-supplied FTP service profile, and then associating that service profile
with a virtual server.
You now have a security-enabled service profile that you can associate with a virtual
server so that FTP protocol checks are performed on the traffic that the FTP virtual
server receives.
Enabling protocol security for an FTP virtual server
When you enable protocol security for an FTP virtual server, the system scans any
incoming FTP traffic for vulnerabilities before the traffic reaches the FTP servers.
The custom FTP virtual server appears in the Virtual Servers list.
Reviewing violation statistics for security profiles
You can view statistics and transaction information for each security profile that
triggers security violations.
