Re: Script in PTF download rejected by Cisco Firepower Intrusion Prevention System (IPS) -- MIDRANGE-L

Rob,

Are you using encrypted FTP? I thought that IBM had moved all ftp downloads
to encrypted awhile ago. The more networking guys want to snoop the more I
tunnel and encrypt.
This is a perfect example of the false positives these DPI tools bring.
Check if you can enable sftp or ftps or ftpes (whatever the secured option
IBM might be using). If the native IBM i FTP client doesn't allow encrypted
connections, you might be able to use one that does in PASE...

Roberto

On Thu, Jun 4, 2020 at 8:23 AM Rob Berendt <rob@xxxxxxxxx> wrote:

Possible bad ptf?

Late last week I started a PTF download from IBM. This resulted in these
files
The CUME_1.bin byte count is: 3815768064
The CUME_2.bin byte count is: 3721482240
The CUME_3.bin byte count is: 3904059392
The CUME_4.bin byte count is: 3807432704
The CUME_5.bin byte count is: 447019008.
When using FTP download from IBM i command line it would die on
CUME_3.bin. Well into it. Repeatable. Multiple lpars. I downloaded them
again and the byte counts were a little different but the same situation.
Same file dies. I gave up and downloaded them to a PC and then uploaded
that to IBM i. This worked.

Got a reply from our network guy:
<snip>
Turns out that the Cisco Firepower Intrusion Prevention System (IPS) was
killing your FTP downloads, because the file contained a script that IPS
did not like.

This was discovered during our weekly Webex meeting dropped traffic
review. Don't know why the same transfer worked from the laptop, but
something must have been different - perhaps binary vs non-binary transfer
mode - I don't know for sure.

There is no good workaround other than what you have already done.
Whitelisting would be putting the systems at risk.
</snip>

So, might there be a bad PTF in there which may corrupt the system?
I have it set to apply on 15 lpars at their next IPL.

I had ordered these PTF's:
MF65856,MF66031,MF66337,MF66879,MF67062,MF67143,MF67216,MF67304,SF99652,SF99653,SF99659,SF99661,SF99662,SF99663,SF99664,SF99665,SF99666,SF99667,SF99668,SF99675,SF99704,SF99736,SF99737,SF99738,SF99739,SF99740,SF99741,SI69396,SI69632,SI69635,SI69892,SI69943,SI70236,SI70319,SI70368,SI70542,SI70552,SI70572,SI70591,SI70626,SI70716,SI70749,SI71060,SI71396,SI71601,SI71638,SI71876,SI71972,SI71975,SI72020,SI72305,SI73026,SI73201,SI73239,SI72590,
SI71719, MF67191, MF65997, MF66894, MF67002, MF67004

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com