Illegal port number in EPSV reply

[VaudeSport]

We use a FortiGate 601E with v6.4.9.
Since the last firmware upgrade, FTP transfers with EPSV have been failing. Locally, the FTP server responds with "|||PORT|." However, the FortiGate translates this to "|||PORT" (the final "|" is missing).
Transfers with PASV continue to work.
I can't disable the session helper because it's required for PASV.

[AlexC-FTNT]

The first step before everything is to bring that firmware into the real world (at least 7.2.12, and  recommended 7.4.8) and start troubleshooting from there. The issue may have been fixed already.

[InformaticaHN]

Have this exact issue on our 80F after upgraded from v7.2.11 to v7.2.12 and on our 40F after the same upgrade. Tried to upgrade the 40F to v7.4.9 with no success. Back to v7.2.11 on 40F to be able to work normally.

[AlexC-FTNT]

I doubt the "exact issue" is the best wording here. I am running multiple FTP servers over FG with 7.2.12 without facing this problem. Filezilla in my case uses PASV command on every server connection. EPSV is used in IPV6 only. Check your inspection profiles in policy(test by removing them all, or using deep/inspection+proxy-mode policy), and make sure the FTP session-helper was not deleted by mistake.

[InformaticaHN]

With "exact issue" I mean our FTP server (Microsoft) is answering

< 229 Entering Extended Passive Mode (|||55752|)

if not passing through FG and

< 229 Entering Extended Passive Mode (|||55690)

if traffic is going through FG.

FTP session-helper is alive and using no-inspection in affected policy. Thanks.

[AlexC-FTNT]

Entering Extended Passive Mode -- simply says that it tries to open a new session for that port number. About the trailing delimiter, per RFC 2428 it must exist: 
229 Entering Extended Passive Mode (|<protocol>|<address>|<port>|)

So if you don't see this in a packet capture on a FortiGate, as it exists the FortiGate interface, feel welcome to open a case with support. I don't see any similar report about this at this moment, and lab shows no problem:

> EPSV
* Connect data stream passively
{ [5 bytes data]
< 229 Entering Extended Passive Mode (|||34403|)
* Trying 10.109.200.44:34403...
* TCP_NODELAY set
* Connecting to 10.109.200.44 (10.109.200.44) port 34403
* Connected to 10.109.200.44 (10.109.200.44) port 990 (0)

[InformaticaHN]

Thanks for your response. I've had a support case for our 40F since September 29th, shortly after updating to v7.2.12. I hope they find an explanation soon.