How to configure virtual server for FTP/SFTP

Hi Domel,

There is a difference between SFTP and FTPS.

SFTP is easy to implement. Just use a virtual server on TCP/22 and you are done.

FTPS works like FTP but is using a secure channel for the control connection.

That´s why the the ftp-profile cannot a) rewrite the PORT command and b) open a listener on client-/serverside depending on using passive or active FTP.

I guess your issue is about FTPS and I would recommend to start with a dedicated server for this service.

Actually it should be easy to implement as well, if you try to use passive FTP only.

The FTP server needs to be reconfigured to announce the virtual server´s IP address and perhaps you are also able to limit the used port range for the inbound data connection. That´s why your virtual server for FTPS can run in PerformanceL4 listening on port 0 (any) with SNAT AutoMap and source address persistence configured.

You can limit incoming traffic to the virtual server via iRule or AFM:

when CLIENT_ACCEPTED {
    if { not (([TCP::local_port] == 21) or (([TCP::local_port] >= 50000) and ([TCP::local_port] < 50003)))} {
        reject
    }
}

Thanks, Stephan

Hi Stephan,

I'm actually trying to configure SFTP (not FTPS) on port 22.

This should be fairly simple but or some reason it doesn't work for me.

I have created a node with my physical server, assigned it to my ftp_pool using port 22, used that pool for my virtual server but no luck.

I have tried to configuring the virtual server as "Standard" and as "PerformanceLayer4" and still nothing.

Is there anything else I need to do?

Hi Stephen,

What am I supposed to select from the drop down menu for SFTP server?

I have configured a new profile called SFTP. Not too sure if correctly, but was wondering if I can chose FTP for the "Ftp Profile" or it won't work?

BIG-IP 11.4.1 Build 608.0 Final

I have tried PerformanceL4 but no luck either.

sftp option isn't available unless configured.

What is the difference between "standard" and "PerformanceL4"??

Hi Stephan,

Thanks a lot for your help.

It looks like the PerformanceL4 works this morning - wasn't working on Friday/Saturday when I have tested it (no too sure why). I have also tried to use "Standrad" one but no luck.

Hi there,

It looks like the issue was intermittent.

I have been told by F5 support when "AutoMap" enabled for the Virtual server the "Address Translation" will also need to be enabled while "Port Translation" disabled.

Also we have configured "sftp" monitor little bit differently and it work too:

Hi Stephan,

Am working on the same issue , activeFTP and FTPS (ftp in explicit mode). Could you advice on the way to implement it.