> Source: [sk102528](https://support.checkpoint.com/results/sk/sk102528)

# sk102528 - How to pass FTPS traffic through Security Gateway without inspection

| Property | Value |
|----------|-------|
| Solution ID | sk102528 |
| Date Created | 2014-09-16 |
| Last Modified | 2022-09-21 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- FTPS traffic is dropped by Security Gateway (for example, after enabling the DLP blade - even in 'Detect' mode).

## Cause

FTPS traffic on TCP port 21 (Control Connection) is encrypted. As a result, FTP Security Server ('`in.aftpd`' daemon) is unable to parse the messages and drops the connection.

## Solution

### Introduction

FTP Security Server is able to bypass FTPS traffic on TCP port 21 (Control Connection) - FTP Security Server will pass all FTPS connections between Client and Server without inspection from the moment the connection is recognized as FTPS.

Behavior of FTP Security Server is controlled with the help of attribute '***`FTP_ALLOW_FTPS_BYPASS`*** ' in Check Point Registry (`$CPDIR/registry/HKLM_registry.data`):

|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Value                       | Behavior                                                                                                                                                                                                      |
| `FTP_ALLOW_FTPS_BYPASS = 0` | FTP Security Server will inspect all FTPS connections (this is the default). **Note:** By default this attribute does *not* exist in the Check Point Registry (which is equivalent of assigning the value 0). |
| `FTP_ALLOW_FTPS_BYPASS = 1` | FTP Security Server will pass all FTPS connections between Client and Server without inspection.                                                                                                              |

*Example from Check Point Registry (`$CPDIR/registry/HKLM_registry.data`)*:

```
("CheckPoint Repository Set"
: (SOFTWARE
: (CheckPoint
: (CPshared
... ...
: (FW1
:CurrentVersion (6.0)
: (6.0
... ...
:FTP_ALLOW_FTPS_BYPASS (1)
... ...
```

### Procedure

**Note:** In cluster environment, this procedure must be performed on all members of the cluster.  
Show All Instructions

* Show / Hide instructions for R77.10 and higher  

  1. Connect to command line on Security Gateway.   

  2. Log in to Expert mode.   

  3. Check the current value of the attribute '*`FTP_ALLOW_FTPS_BYPASS`*' in Check Point Registry:

     **`[Expert@HostName]# grep FTP_ALLOW_FTPS_BYPASS $CPDIR/registry/HKLM_registry.data`**
     Note: If the output is empty, it means that the attribute does not exist in the Registry (this is the default).   

  4. Set the desired value of the attribute '*`FTP_ALLOW_FTPS_BYPASS`*' in Check Point Registry:

     **Important Note:** This change is applied immediately to the traffic and it is permanent (survives reboot).
     * To pass FTPS traffic without inspection:

       **``[Expert@HostName]# ckp_regedit -a SOFTWARE\\CheckPoint\\FW1\\`cpprod_util CPPROD_GetCurrentVersion FW1` FTP_ALLOW_FTPS_BYPASS 1``**   

     * To inspect FTPS traffic (default):

       **``[Expert@HostName]# ckp_regedit -d SOFTWARE\\CheckPoint\\FW1\\`cpprod_util CPPROD_GetCurrentVersion FW1` FTP_ALLOW_FTPS_BYPASS``**

     <br />

     <br />

  5. Check the value of the attribute '*`FTP_ALLOW_FTPS_BYPASS`*' in Check Point Registry:

     **`[Expert@HostName]# grep FTP_ALLOW_FTPS_BYPASS $CPDIR/registry/HKLM_registry.data`**   

  6. Create the following explicit security rule to allow the FTPS traffic (Control Connection and Data Connection) to pass:

     |------------|-----------------|------------------------|----------|-------------------------|
     | SOURCE     | DESTINATION     | SERVICE                | ACTION   | INSTALL ON              |
     | FTP Source | FTP Destination | `ftp` `tcp-high-ports` | `Accept` | Security Gateway object |

     <br />

     <br />

  7. Edit the "Comment" field of security rule to document that sk102528 was applied so that if FTP stops in future you know how it was resolved.  

  8. Install the policy on the Security Gateway.  

  9. Reboot the Security Gateway.

  <br />

  <br />

* Show / Hide instructions for R77 and lower  

  1. [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
     A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
     For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.   

  2. Hotfix has to be installed on **Security Gateway**.

     **Note:** In cluster environment, this procedure must be performed on all members of the cluster.   

  3. Transfer the hotfix package to the machine (into some directory, e.g., `/some_path_to_fix/`).   

  4. Unpack the hotfix package:

     ```
     [Expert@HostName]# cd /some_path_to_fix/
     [Expert@HostName]# tar zxvf fw1_wrapper_HOTFIX_NAME.tgz
     ```

  5. Install the hotfix:

     **`[Expert@HostName]# ./fw1_wrapper_`*HOTFIX_NAME***
     Note: The script will stop all of Check Point services (`cpstop`) - read the output on the screen.   

  6. Reboot the machine.   

  7. Connect to command line on Security Gateway.   

  8. Log in to Expert mode.   

  9. Check the current value of the attribute '*`FTP_ALLOW_FTPS_BYPASS`*' in Check Point Registry:

     **`[Expert@HostName]# grep FTP_ALLOW_FTPS_BYPASS $CPDIR/registry/HKLM_registry.data`**
     Note: If the output is empty, it means that the attribute does not exist in the Registry (this is the default).   

  10. Set the desired value the attribute '*`FTP_ALLOW_FTPS_BYPASS`*' in Check Point Registry:

      **Important Note:** This change is applied immediately to the traffic and it is permanent (survives reboot).
      * To pass FTPS traffic without inspection:

        **``[Expert@HostName]# ckp_regedit -a SOFTWARE\\CheckPoint\\FW1\\`cpprod_util CPPROD_GetCurrentVersion FW1` FTP_ALLOW_FTPS_BYPASS 1``**   

      * To inspect FTPS traffic (default):

        **``[Expert@HostName]# ckp_regedit -d SOFTWARE\\CheckPoint\\FW1\\`cpprod_util CPPROD_GetCurrentVersion FW1` FTP_ALLOW_FTPS_BYPASS``**

      <br />

      <br />

  11. Check the value of the attribute '*`FTP_ALLOW_FTPS_BYPASS`*' in Check Point Registry:

      **`[Expert@HostName]# grep FTP_ALLOW_FTPS_BYPASS $CPDIR/registry/HKLM_registry.data`**   

  12. Create the following explicit security rule to allow the FTPS traffic (Control Connection and Data Connection) to pass:

      |------------|-----------------|------------------------|----------|-------------------------|
      | SOURCE     | DESTINATION     | SERVICE                | ACTION   | INSTALL ON              |
      | FTP Source | FTP Destination | `ftp` `tcp-high-ports` | `Accept` | Security Gateway object |

      <br />

      <br />

  13. Edit the "Comment" field of security rule to document that sk102528 was applied so that if FTP stops in future you know how it was resolved.  

  14. Install the policy on the Security Gateway.  

  15. Reboot the Security Gateway.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content