FTP/SSL Problem Behind Checkpoint

[rmmagow]

R61 running on a Nortel Alteon platform.
I am the "client" side. I am using CuteFTP as the client code. I am trying to connect to an FTP server hosted by a state agency. I think it is an IBM mainframe but it doesn't matter I don't think. CuteFTP is set up to connect FTP with SSL (AUTH SSL- Explicit) over port 21. A Straight connection, the client machine on DSL connecting to the state agency's FTP server works fine. If I try to run the client behind the firewall, using the firewall's hide-behind address it fails with SSL:Error in negotiating SSL Connection. I've tried virtually everything I can think of for services, ftp-bidir, port based, PASV, any any any ETC ETC. No DROPS in the logs but I am getting some warnings from Smart Defense. Nothing in SD is set up to drop anything but....
I've even tried to setup the client so it would NAT to a real outside IP address when connecting to the server at the state agency. They are unable to help me and will not change anything on their side. I've Googled this problem and apparently it really is a problem, but I have not seen any kind of solution proposed.
I pretty badly lost here and hope one of our experts can shed a little light on what's going on and how I might be able to fix this problem.
Thanks Very Much.

 

[rmmagow]

Anybody there?? I really need help here.
THANK YOU!!!

 

[rn4it]

What are the warnings SD is biving you? It might not be dropping on your side, but they may be dropping it.

 

[rmmagow]

Hmm, didn't think of that. I'll send the exact message I'm seeing in the morning. State governments are DIFFICULT to deal with, almost zero help tryng to figure out what's going on here. My sniffer traces didn't help much since it's failing at the hand-shake level of key exchange.
THANKS!

 

[rn4it]

You may want to see if there is a setting within the FTP application that won't trigger the alerts in SD. CP is very particular about how services work through it, if it varies fom the RFC then CP doesn't like it. You may need to look at a different FTP application. The state agency probably won't do much if it's being dropped on their side, I wouldn't open up my FW to allow and application through that was setting off alerts of potential attacks.
good luck