Focal Point
FTP Windows Firewall -Public blocking

This topic can be found at:
https://forums.informationbuilders.com/eve/forums/a/tpc/f/7971057331/m/6987004816

March 29, 2012, 12:36 PM
brad-s
FTP Windows Firewall -Public blocking
I have an FTP running via a FEX to transfer a small text file to a remote server location.
Using Windows 7 with Focus 7.7.03

On many sites, the FTP runs successfully.
But on a select few, the FTP is not processing.
The process just sits there for 5 minutes until timed out.

But if I use Control Panel/Wirefall and Turn OFF just the the Public Network, it runs successfully in 10 seconds.

What setting am i missing on these select PCs that prevents the FTP via the FEX from running successfully?


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve
March 29, 2012, 04:49 PM
Waz
Some sort of subnet masking issue ?

Are the IP address ranges different ?


Waz...

Prod:WebFOCUS 7.6.10/8.1.04Upgrade:WebFOCUS 8.2.07OS:LinuxOutputs:HTML, PDF, Excel, PPT
In Focus since 1984
Pity the lost knowledge of an old programmer!

April 03, 2012, 05:06 PM
brad-s
How do I tell if it a subnet masking?

Not sure you what you mean by differnt IP addresses?


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve
April 03, 2012, 06:04 PM
Waz
If you run ipconfig you will get the machines IP address and subnet mask.

Compare this with the ip address of the remote server.


Waz...

Prod:WebFOCUS 7.6.10/8.1.04Upgrade:WebFOCUS 8.2.07OS:LinuxOutputs:HTML, PDF, Excel, PPT
In Focus since 1984
Pity the lost knowledge of an old programmer!

April 04, 2012, 01:53 PM
George Patton
Try using the IP address of the remote machine and not the domain name ....


WebFOCUS 7.7.05 Windows, Linux, DB2, IBM Lotus Notes, Firebird, Lotus Symphony/OpenOffice. Outputs PDF, Excel 2007 (for OpenOffice integration), WP
April 09, 2012, 10:42 AM
brad-s
The sub net mask was the same 255.255.255.0

Tired using the domain name and the IP address but still same block.

The only thing that solves it at this point is turning Windows Firewall OFF. Tried adjusting (enabling) some individual settings in the Windows Firewall but nothing so far.
All OFF works in these selected cases but ON still blocking.


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve
April 09, 2012, 06:39 PM
Waz
The subnet mask is applied to the IP address, in its simplest form, 255 means its accepted, and 0 means rejected.

If you have an IP address of 192.168.0.1, and a subnet of 255.255.255.0, and try to connect to 192.168.1.2, then one of the first three parts does not match, and won't work.

The way that you get to IP ranges not allowed is via gateways.

The only other thing that could stop connections are firewalls in things like routers.

What happens if you ping the destination IP from these machines ?


Waz...

Prod:WebFOCUS 7.6.10/8.1.04Upgrade:WebFOCUS 8.2.07OS:LinuxOutputs:HTML, PDF, Excel, PPT
In Focus since 1984
Pity the lost knowledge of an old programmer!

April 10, 2012, 11:34 AM
George Patton
quote:
What setting am i missing on these select PCs that prevents the FTP via the FEX from running successfully?

I've just looked at your original question more carefully. If I understand it correctly you are using FTP to send the small file to a bunch of different machines, presumably one after the other. This works sending to some machines, but not others.

If I'm understanding things properly, the problem lies with the remote machines, not at the sending end.

I assume that these machines are not on your local network which is why you are using FTP.

Are they all running the same operating system?
Is the FTP daemon (process) actually running on the machines tha won't connect?
Are you sending to teleworkers who might be using a service provider who blocks FTP?

Have you looked into alternatives to FTP? It's not very secure (username and password are sent in clear text)?


WebFOCUS 7.7.05 Windows, Linux, DB2, IBM Lotus Notes, Firebird, Lotus Symphony/OpenOffice. Outputs PDF, Excel 2007 (for OpenOffice integration), WP
April 11, 2012, 05:02 PM
brad-s
To clarify,
my FTP is sending just one small file to one remote server that is not on the local network.

The process works 98% of the time. That is, a variety of PCs are successful at the FTP process of transferring a small file from the PC to the network server.

All of the WinXP PCs are successful. Most of the Win7 Pcs are successful but the few that are not successful are all Win7 PCs.

From a command prompt, I can manually FTP the file to the network server using FTP and a script file. But when run from WebFocus 7703, the FTP process fails on these rare situations.


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve
April 11, 2012, 05:42 PM
Waz
Ah, so its intermittent.

Are these failures happening at exceptional times, like high volume network traffic, or perhaps down time when the server is having maintenance.

Is there any more info on the failure, e.g. some sort of error message. Can you turn tracing on to capture some of this detail, or at least pipe the results of the FTP to a file for later checking.


Waz...

Prod:WebFOCUS 7.6.10/8.1.04Upgrade:WebFOCUS 8.2.07OS:LinuxOutputs:HTML, PDF, Excel, PPT
In Focus since 1984
Pity the lost knowledge of an old programmer!

April 12, 2012, 01:02 PM
brad-s
Thanks for your follow up response....

On the PCs that it happens on, it never runs successfully.

We echo the processing and when the focexec runs the FTP command, it just hangs for 5 minutes.

On those same PCs, we can externally run the FTP command successfully.

Seems like there is some Windows or Firewall setting or something preventing the processing when executed thry a focexec. Again, we have turned off Anti-virus and turned off Windows Firewall and still the same hang up.


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve
April 12, 2012, 05:55 PM
Waz
This is quite weird.

A shot in the dark...
Does the WebFOCUS process run under a different user ?

I think you may have to get Techsupport in on this one.


Waz...

Prod:WebFOCUS 7.6.10/8.1.04Upgrade:WebFOCUS 8.2.07OS:LinuxOutputs:HTML, PDF, Excel, PPT
In Focus since 1984
Pity the lost knowledge of an old programmer!

April 13, 2012, 10:10 AM
George Patton
quote:
That is, a variety of PCs are successful at the FTP process of transferring a small file from the PC to the network server...All of the WinXP PCs are successful. Most of the Win7 Pcs are successful but the few that are not successful are all Win7 PCs.

You are transferring a file from a variety of PCs to the server. The FEX file in question resides on and is executed by the server. That means that rather than pushing the file from the PC to the server it is the other way around - the server initiates the FTP session and pulls the file from the PCs using an FTP GET command.

If I follow that logic I would look at these:
1) Are you sure the PCs that don't work have static IPs?
2) If they are behind a firewall is the NAT configured properly?
3) On the PCs is the FTP process operating in listen mode?
4) Is the firewall on the PCs configured to allow inbound FTP access?

quote:
On those same PCs, we can externally run the FTP command successfully.

So in this case you are pushing the file FROM the PC to the server - which is quite different, and probably a good idea, although I sure as heck wouldn't use plain old FTP.

Google PSCP and have a look. It's free and brilliant - and you can schedule a batch job to push your files from the workstation using the Windows scheduler if you want.


WebFOCUS 7.7.05 Windows, Linux, DB2, IBM Lotus Notes, Firebird, Lotus Symphony/OpenOffice. Outputs PDF, Excel 2007 (for OpenOffice integration), WP
April 13, 2012, 02:11 PM
brad-s
Thanks for the info.
PSCP looks promising. I will investigate.

1. The PCs have a static IP
2. NAT - these PCs are accepting files from that same server. They just can seem to send a file via FTP. Is there part of the configuration of NAT I can check?
3. Not sure how to check FTP process is in listening mode.
4. I configure the Windows firewall to allow all processes. I even turned the Windows firewall completely off.


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve
April 15, 2012, 09:34 AM
George Patton
If the connection initiated from the server to the PCs is working then you don't have a firewall issue on the PCs.

You say you can manually FTP the other way - from the PC to the server as well. The problem only arises when you run a FEX on the server that has somewhere, presumably, a GET command. So the server is initiating, via the FEX, the FTP session. In that case I would look very carefully at the FTP user name and password the FEX is using. Maybe someone keyed in a space that you aren't seeing as part of the user name or password. This is likely at the PC end of things.

Why don't you post the relevant part of your FEX. That might help.


WebFOCUS 7.7.05 Windows, Linux, DB2, IBM Lotus Notes, Firebird, Lotus Symphony/OpenOffice. Outputs PDF, Excel 2007 (for OpenOffice integration), WP
April 16, 2012, 08:22 AM
brad-s
Good advice. I have carefully verified the username/password and they are correct.

Here is the FEX that runs.
(I masked a few items on this email for security purposes.)

It first sets up an FTP script file(SCRIPT.ONE)
then tries to run the FTP with the script file.
This is in one FEX. The code is continuus (that is. not taken from two parts of the same fex)



-*****set up the ftp script file ******
-SETHDCA
-SET &OPNHDCA = 'open 155.16.44.xx';

-SET &DL1 = 'UPL' | &GFAC | '09.TWO';
DEL &&CLNTLOC|&DL1
-RUN

DEL &&CLNTLOC|SCRIPT.ONE
-RUN

FILEDEF SCRPT DISK &&CLNTLOC|SCRIPT.ONE (APPEND
-*
-SET &QTT = 'quit';
-RUN
-WRITE SCRPT &OPNHDCA
-WRITE SCRPT &S2KID
-WRITE SCRPT &S2KPASS

-SET >1 = 'get glxfer/c1psecur ';
-SET >2 = &&CLNTLOC | &DL1;
-SET >3 = >1 | >2;
-WRITE SCRPT >3
-WRITE SCRPT &QTT
-RUN


-************ RUN THE SCRIPT FILE......
-SET &JHHHH = 'ftp -s:' | &&CLNTLOC | 'script.one';
DOS &JHHHH
-RUN



AND THIS IS THE FTP SCRIPT FILE THAT IS CREATED:

open 155.16.44.xx
SKNMExxx
PERMAYxx
get glxfer/c1psecur C:\IBI\APPS\SINGLE\UPL93309.TWO
quit


When the FTP command is run, there is no response. Again, from the same site, on computer A is works. On computer B, it does not. Not sure of the setting on computer B that I need to check.


Brad S.
WF 8.05 / Win7 /Tomcat Self Serve