Forum Discussion

Vadim_Tugai_951's avatar
Vadim_Tugai_951
Icon for Nimbostratus rankNimbostratus
Mar 16, 2005

FTP reverse-proxy

Has anyone tried to use F5 (v9) as an FTP reverse proxy?

 

We use F5 as a reverse-proxy for HTTP and would like to cover FTP traffic as well (validating the L5-L7 traffic to confirm that it is really FTP).

 

 

Have there been any FTP-specific iRule command-sets defined (similar in functionality to to the HTTP:: commands).

 

 

Ideally such FTP command-set would:

 

- support both passive and active FTP (while F5 acts as a full application-layer FTP proxy)

 

- analyse/validate FTP application traffic across both FTP sessions (control and data)

 

- have an ability to limit FTP commands that can be used for certain FTP directories (eg. if a directory is read-only - only "ls", "get" and "mget" should be allowed)

 

- proxy the user authentication to the end-server while providing filtering (eg. in some cases a user "anonymous" should be blocked at the proxy level)
application delivery
dev
devops
iRules

3 Replies

Sort By
  • Brian_Gupta_115's avatar
    Brian_Gupta_115
    Icon for Nimbostratus rankNimbostratus
    Aug 03, 2005
    I got FTP reverse proxy working.. using the standard FTP profile (supports active and passive, no iRule needed) The authentication is done at the backend by default.

     

     

    Some of iRule functionality you want, IE: filtering, I can help you with.

     

     

    As for validating whether it is actual FTP traffic, what are you concerned about? (Give me an example of non-ftp traffic that you would want to block)

     

     

    The ability to limit commands can probably be done but it is probably more than I want to bite off.

     

     

    Feel free to contact me if you need any help.

     

     

    Cheers,

     

    Brian
  • Michael_Woods_5's avatar
    Michael_Woods_5
    Icon for Nimbostratus rankNimbostratus
    Jan 05, 2007
    Hey brandorr,

     

     

    What did you do to get the reverse-proxy working using profiles?

     

     

    Thanks and Happy New Year,

     

    Mike