SD stopping Secure FTP

[K2Technologies]

The accounting dept at our company uses Secure FTP with Wells Fargo to transfer data for our 401k program. Their system uses ports 3000-3200 for the connection and SmartDefense is killing the connection and giving the following (vague) log entry.

What do I need to do to get SD to accept Sec FTP over the non-standard ports?

Number: 48603
Date: 25May2007
Time: 16:55:11
Product: SmartDefense
Interface: eth2
Origin: Cheyenne (172.24.1.15)
Type: Log
Action: Drop
Protocol: tcp
Service: https (443)
Source: 172.16.1.133
Destination: wellsfargo.com (209.84.206.42)
Source Port: 2904

[munrog]

Its going to be hard to see why the packets are being dropped because there isnt much information here. Is this all the information on the SmartDefense alert? Is there anything in the "Attack Name" or "Attack information" or the "Information" fields?

I had something similar, but in my case, some bozo had changed the https service advanced properties, protocol type to HTTP from ENC-HTTP.

Took me absolutely ages to find it!

[RayPesek]

Originally Posted by K2Technologies

Their system uses ports 3000-3200 for the connection and SmartDefense is killing the connection and giving the following (vague) log entry.
...
Service: https (443)

Doesn't the log entry show they are trying to connect to Wells Fargo on TCP 443, not 3000-3200?

Ray