"tried to open a known service port"

[infrared013]

I am hoping someone might be able to shed some light on an issue one of my customers recently having. During an FTP session the connection drops randomly and in the logs I see a rejected packet where the source port ha changed to something very bizarre such as edonkey_4661, shadyshell, subseven-g etc etc....we disabled the "prevent known port checking" in smart defense however the problem still continues.

If anyone has any information it would be greatly appreciated.

Thanks

[Danielpb]

Hi
Just to make sure Smart Defense is not stopping the ftp port you could try and create a new ftp services but with out any of the advance settings configured.

then use the services in the rule base.

see if that makes any difference

[RayPesek]

Look for a SD setting for "allow connections to defined service ports" or something like that. As I recall, it's a three radio button selection and the default is not what you want. You want it allowed.

Ray