We've reached the end of the IPv6 FTP module, so let's quickly recap.
By far,
the most interesting topic of this module was exploring the new
extended port and extended passive messages.
These are defined in RFC 2428 and enable FTP to work in
IPv6 environments by updating the critical messages used
for both active and passive modes.
Migrating FTP to IPv6 is relatively easy,
especially compared to other complex enterprise applications.
Sometimes the FTP server needs a few configuration changes,
such as enabling the IPv6 flag in the TFTP configuration,
but overall, it is a low-effort process.
Because the layer 4 ports and general communication flows don't change,
securing the IPv6 FTP variants is also largely unchanged.
Just be sure to capture you IPv6 addresses correctly and
account for any critical ICMPv6 traffic.
To learn more about ICMPv6's role in maintaining IPv6 networks,
check out my ICMP Protocol Deep Dive course,
at Pluralsight.
At last, we have reached the end of the FTP Protocol Deep Dive course.
We spent the first two modules digging into how FTP
active and passive modes operate.
We discussed their individual tradeoffs and I offered the general recommendation
that passive mode should be used whenever a choice exists.
For additional security,
administrators can constrict the range of TCP ports used in
passive mode to reduce the attack surface even more.
Next, we explored some secure FTP options, such as FTP Secure and SSH FTP.
FTP Secure relied on SSL certificates to protect the existing FTP
communications without impacting the TCP flows at all,
making it an easy way to secure an existing FTP
deployment without firewall updates.
SFTP is an entirely new and technically non-standard protocol,
but is very commonly deployed and can simplify greenfield FTP
deployments by minimizing the firewall rule set.
I also discussed TFTP,
a simple and unsecure protocol that works perfectly in your internal network.
Finally, I want to extend my sincere gratitude to you for viewing this course.
Feel free to contact me on Twitter with any questions you have.
Be sure to check the course page for links to the
packet captures used in the course. Thank you.