Fortigate and filezilla in active mode

Forum|Forum|2 years ago
September 6, 2023
6 replies
6420 views

Hi,

I want to understand what is the right behavior of the Fortigate in a scenario where I have an FTP server and a filezilla client that use the "ACTIVE" mode.

the client is on the INSIDE interface and the FTP server is in DMZ.

I create a rule for allow the traffic from INSIDE to port 21 in DMZ.

Do i need a rule from DMZ to INSIDE? I see that FTP server use source port 20 and client destination port random >1024.

FortiGate

A

Anonymous_User

Contributor III

Hello DanieleS99,

Please check the below guide.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Allowing-FTPs-over-FortiGate-FTPs-sFTP-SFTP/ta-p/224345

Yes in active mode you've to explicitly open the FTP port communication from server to client otherwise it will not work.

spoojary

Staff

In a scenario with an FTP server in the DMZ and an FTP client on the INSIDE using active mode, you should:

Allow outbound traffic from the INSIDE to the DMZ on port 21 (FTP control channel).
Enable the FTP session helper on your FortiGate firewall to automatically handle related data channel connections.

You generally don't need explicit rules for the FTP server to initiate connections back to the client on high-numbered ports. The FTP session helper should manage this for you.