SSH public key authentication fails due to firewall rule

Question

We had a really tricky SSH public key authentication issue with a customer recently. They were trying to use public key authentication via the openssh client, but it wasn't working. It seemed that it didn't recognise that CompleteFTP was sending back the public key authentication method as one of the methods it could proceed with.

Answer 1

The solution was for the customer to change their firewall policy from “Proxy-based” to “Flow-based” in inspection mode.

Our conclusion is that the firewall's proxy-based mode is buggy. Proxy-based inspection acts as an intermediary between the client and server. It terminates and inspects traffic, then establishes a separate connection to the destination server. We assume that it was failing to pass the correct details as to which authentication methods were available to the client.