😟😟😟Background of Actual problem :
I am working for Banking client who is doing business with their partners by sending payment files using different communication channels like SFTP , HTTP , API etc. For first time one partner come up with integration requirement by using FTPS communication which is new to our banking client. My client using IBM Sterling Integrator as B2B/EDI tool to do integration with partners and this is the first partner using FTPS connectivity. While implementing and getting connectivity established with partner , we encountered many issues with their FTPs Server.
😮😮😮Problem Statement :
When we trying to connect and to do list out the files which are available in their remote directory , initially we are getting handshake failure and cannot move forward to do list files operation. We have already opened outbound ports at bank firewall and customer are also opened bank ports at their side. As part of analysis we have asked partner to provide acceptable ciphers at their side and compare with ciphers which are configured at Bank side.while initial analysis we found that there is Ciphers mismatch at handshake and it causes the issue.
😲😲😲Suggestion :
To resolve this issue, we have conducted multiple debugging sessions with all the stakeholders partner , Bank's team (myself) , Network team , operating system admin and B2B application vendor etc. In each session we have implemented below suggestions/changes mentioned at B2B server level by B2B vendor team and did the testing in meeting when all the stake holders are present and do the monitoring the traffic.Initially we asked to do below mentioned changes at their FTPS server side and they didn't aggree to do changes. Partner side they cannot make necessary changes to accepts ciphers which are configured at bank because already they are integrated with their partners and they dont want to expect any issues with their partners by cipher changes.
- SNI need to be disabled
- TLS 1.3 version need to disabled if it is enabled already and TLS1.2 version should be default
<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3718162507869387"
crossorigin="anonymous"></script><script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3718162507869387"
crossorigin="anonymous"></script>
<!-- MySquareAd -->
<ins class="adsbygoogle"
style="display:block"
data-ad-client="ca-pub-3718162507869387"
data-ad-slot="5896879220"
data-ad-format="auto"
data-full-width-responsive="true"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
