Network Connectivity - How do I fix a failed FTP test if I'm using a Sonicwall?

If you test your FTP settings in Switchvox under tools > call recordings > call recording settings and it fails the large file test, do the following:

1. Go to Server > Advanced Debugging and start a packet capture

2. Go back to Tools > Call Recordings > Call Recording Settings and run the test

3. Open the packet capture in Wireshark and filter for the IP of the FTP server (for example: ip.addr==10.10.10.10)

4. You will see an RST (reset connection) packet coming from the FTP server to the PBX, then immediately after, the PBX closing the connection

If you see this, you can then do the following:

1. Log into the Sonicwall

2. Go to Security Services > Intrustion Prevention

3. Under IPS Global Settings, ensure that Prevent All and Detect All are both checked for All Priority Attacks.  If Detect All is NOT checked, the transmission will be blocked but nothing will be logged indication that it is being blocked

4. Open Logs > View

5. Go back to Tools > Call Recordings > Call Recording Settings and run the test

6. You should see the Intrusion Prevention now log the activity from the Switchvox IP address

7. It will capture intrusion: Client Application Shellcode Exploit 30

You will now want to disable this particular exploit from Detection and Prevention.  There no way to exclude a single IP from this list, but you do have the option to exclude a range.  In our steps below we disabled detection of this exploit altogether:

1. Log onto the Sonicwall

2. Go to Security Services > Intrustion Prevention

3. Scroll down to the IPS Policies section and select Exploit from the Category drop down list

4. Scroll down and edit Client Application Shellcode Exploit 30

5. Modify the settings for Prevention and Detection, and set them both to Disabled