Description

For SSH File Transfer Protocol (SFTP) and FTP over SSL (FTPS) traffic to pass through an SRX device, a different application must be permitted in the security policy for each. The application that must be permitted for SFTP is junos-ssh ,  and for FTPS it is ​junos-ftp . The two configurations required to enable SFTP and FTPS traffic to pass through an SRX device are described in this article.
 

Solution

The following two configurations are required to enable FTPS and SFTP traffic to pass through an SRX device.

The permit applications ​junos-ssh for SFTP and junos-ftp for FTPS must be configured as follows:


SFTP 
root@ubuntu-01:/home/netscreen# sftp [email protected]
[email protected]'s password:
Connected to 192.168.20.1.
sftp> ls
flow-trace         jinstall-ex-4300-18.2I20180314_0946_xxxxxx-signed.tgz  
junos              junos-srx5000-15.1I20180322_2204_xxxxxx-domestic.tgz  

Session ID: 74393, Policy name: p2/5, Timeout: 1798, Valid
  In: 192.168.200.254/56814 --> 192.168.20.1/22;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 27, Bytes: 3665,
  Out: 192.168.20.1/22 --> 192.168.200.254/56814;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 27, Bytes: 7765, 
The application that is permitted here is junos-ssh. 

policy p2 {
        match {
            source-address any;
            destination-address any;
            application junos-ssh;
        }
        then {
            permit;
 
FTPS
Configure set security alg ftp ftps-extension . For more information, refer to KB19444 - How to let FTPS pass through an SRX device [juniper.net] . 
lftp [email protected]:~> ls
-rw-------    1 ftp      ftp      165787 Feb 06 17:05 flow-trace
-rw-r--r--    1 ftp      ftp      226481073 Mar 15 10:13 jinstall-ex-4300-18.2I20180314_0946_xxxxx-signed.tgz
 
Session ID: 56986, Policy name: p1/4, Timeout: 1792, Valid
Resource information : FTP ALG, 1, 0
  In: 192.168.200.254/40296 --> 192.168.20.1/21;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 18, Bytes: 1415,
  Out: 192.168.20.1/21 --> 192.168.200.254/40296;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 17, Bytes: 2966,
 
policy p1 {
        match {
            source-address any;
            destination-address any;
            application junos-ftp;
        }
        then {
            permit;
        }
    }
 
    alg {
        ftp ftps-extension;