Forum Discussion
Vadim_Tugai_951
Nimbostratus
NimbostratusFTP reverse-proxy
Has anyone tried to use F5 (v9) as an FTP reverse proxy?
We use F5 as a reverse-proxy for HTTP and would like to cover FTP traffic as well (validating the L5-L7 traffic to confirm that it is really FTP).
Have there been any FTP-specific iRule command-sets defined (similar in functionality to to the HTTP:: commands).
Ideally such FTP command-set would:
- support both passive and active FTP (while F5 acts as a full application-layer FTP proxy)
- analyse/validate FTP application traffic across both FTP sessions (control and data)
- have an ability to limit FTP commands that can be used for certain FTP directories (eg. if a directory is read-only - only "ls", "get" and "mget" should be allowed)
- proxy the user authentication to the end-server while providing filtering (eg. in some cases a user "anonymous" should be blocked at the proxy level)
Brian_Gupta_115I don't think so. But I am interested in this as well. -Brian- Brian_Gupta_115I got FTP reverse proxy working.. using the standard FTP profile (supports active and passive, no iRule needed) The authentication is done at the backend by default.
Some of iRule functionality you want, IE: filtering, I can help you with.
As for validating whether it is actual FTP traffic, what are you concerned about? (Give me an example of non-ftp traffic that you would want to block)
The ability to limit commands can probably be done but it is probably more than I want to bite off.
Feel free to contact me if you need any help.
Cheers,
Brian 
Michael_Woods_5Hey brandorr,
What did you do to get the reverse-proxy working using profiles?
Thanks and Happy New Year,
Mike