Screen OS

last person joined: 8 months ago 

This is a legacy community with limited Juniper monitoring.

  • 1.  Netscreen 1000 FTP control and data

    Posted 03-03-2009 02:59

    I have been looking on documentation for clarification but cannot find any info. So my question is:-

     

    service timeout for tcp is set to 30 minutes of inactivity,

     

    Because the control port is only used at the beginning and end of the FTP connection does the netscreen tie the two control and data ports together to know not to close the control port down after 30 minutes if the data port is still transffering data?



  • 2.  RE: Netscreen 1000 FTP control and data
    Best Answer

    Posted 03-03-2009 03:53
    No there's an alg (application layer gateway) defiened for FTP so the data sessions are connected to the control session by this alg.


  • 3.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 04:11
    Thanks for the info, is there a way to view the alg, preferably from cli?


  • 4.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 04:50

    You can see enabled / disabled by get alg (suprise huh Smiley Happy) but there's nothing to set for this ALG.

    Message Edited by Screenie on 03-03-2009 01:50 PM


  • 5.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 05:06

    Thanks i tried the get alg under the vsys no output. When i do the get alg on the global it shows the following:-

     

    get alg
    MSRPC    ALG : enabled
    SUNRPC   ALG : enabled
    SQL      ALG : enabled
    SIP      ALG : enabled
    RTSP     ALG : enabled
    H323     ALG : enabled
    MGCP     ALG : enabled
    SCCP     ALG : enabled

     

    So not sure how the above is used for FTP?
     



  • 6.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 05:31

    what about a set alg ?

     

    my SSG5 (ScreenOS 6.1) shows:

     

    instructor-> set ALG ?
    appleichat           Apple iChat ALG
    dns                  DNS ALG configuration
    ftp                  FTP ALG configuration
    h323                 H.323 ALG information
    http                 HTTP ALG configuration
    mgcp                 MGCP ALG
    msrpc                attach ms-rpc alg
    pptp                 PPTP ALG configuration
    real                 REAL ALG configuration
    rsh                  RSH ALG configuration
    rtsp                 attach rtsp rpc alg
    sccp                 SCCP ALG information
    sctp                 SCTP ALG information
    sip                  SIP ALG
    sql                  SQL ALG information
    sunrpc               attach sun-rpc alg
    talk                 TALK ALG configuration
    tftp                 TFTP ALG configuration
    xing                 XING ALG configuration
    instructor-> set ALG FTP ?
    enable               enable FTP ALG
    instructor->

    I'm not aware of any hardware restriction for ALG's.



  • 7.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 06:40

    When i do the set command it gives me the same options as the get

     

    set ALG ?
    h323                 H.323 ALG information
    mgcp                 MGCP ALG
    msrpc                attach ms-rpc alg
    rtsp                 attach rtsp rpc alg
    sccp                 SCCP ALG information
    sip                  SIP ALG
    sql                  SQL ALG information
    sunrpc               attach sun-rpc alg

     



  • 8.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 07:16
    Probably a version difference. Any how I can't imagen control will time-out when data stream is still there.


  • 9.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 07:28
    Thanks for your help with this. We have tested with a ftp connection beyond 30 minutes and it does not close the connection down. Although It would be nice to see either some output on the netscreen or documented info from Juniper.


  • 10.  RE: Netscreen 1000 FTP control and data

    Posted 03-03-2009 11:24

    Hi

     

    We are working on getting a KB out soon. Please ref 

       KB13509 for that in about a week or so and it should be out.