FTP ASPF/ALG

ASPF in FTP active mode

In FTP active mode, the client uses the random port (xxxx) to send a connection request to port 21 on the server to set up a control channel. The client then uses the PORT command to negotiate the port number for the data channel. The negotiated port number is yyyy. After that, the server initiates a data channel request to port yyyy of the client. The server sends data to the client after the data channel is established.

During the security policy configuration, if you permit only the traffic from the client to port 21 of the server, the control connection can be set up. However, after the packet destined from the server to port yyyy on the client arrives at the FW, the packet is not the subsequent packet of the previous connection but of a new connection. To enable the packet to arrive at the client, you must configure a security policy on the FW to permit the packet. Otherwise, the packet cannot pass through the FW, and the data channel fails to be established. As a result, the user can access the server but cannot request data.

However, the port of the data channel is randomly selected during the negotiation. To permit the data on the data channel, you must enable all ports, posing a security risk. The ASPF function is used to resolve the issue, as shown in Figure 1.

Figure 1 ASPF in FTP active mode

The application-layer information of the PORT command carries the IP address and randomly-opened port of the client. By analyzing the application-layer information of the PORT command, the FW can predict the behavior of subsequent packets and create a server map based on the IP address and port in the application-layer information. After the packet for the server to initiate the data connection to the client reaches the FW, the packet matches the server map entry and is no longer controlled by the security policy.

<sysname> display firewall server-map
Type: ASPF, 2.2.2.2 -> 1.1.1.1:yyyy, Zone: ---
   Protocol: tcp(Appro: ftp-data), Left-Time: 00:00:15
   VPN: public -> public

<sysname> display firewall session-table
Current Total Sessions : 2
  ftp  VPN:public --> public 1.1.1.1:xxxx+->2.2.2.2:21
  ftp-data  VPN:public --> public 2.2.2.2:20-->1.1.1.1:yyyy

ASPF in FTP passive mode

In FTP passive mode, the client uses the random port (xxxx) to send a connection request to port 21 on the server to set up a control channel. The client then uses the PASV command to negotiate the port number for the data channel. The negotiated port number is yyyy. After that, the client initiates a data channel request to port yyyy of the server. The server sends data to the client after the data channel is established.

During the security policy configuration, if you permit only the traffic from the client to port 21 of the server, the control connection can be set up. However, after the packet destined from the client to port yyyy on the server arrives at the FW, the packet is not the subsequent packet of the previous connection but of a new connection. To enable the packet to arrive at the server, you must configure a security policy on the FW to permit the packet. Otherwise, the packet cannot pass through the FW, and the data channel fails to be established. As a result, the user can access the server but cannot request data.

However, the port of the data channel is randomly selected during the negotiation. To permit the data on the data channel, you must enable all ports, posing a security risk. The ASPF function is used to resolve the issue, as shown in Figure 2.

Figure 2 ASPF in FTP passive mode

The application-layer information of the PASV Command OK command carries the IP address and randomly-opened port of the server. By analyzing the application-layer information of the PASV Command OK command, the FW can predict the behavior of subsequent packets and create a server map based on the IP address and port in the application-layer information. After the packet for the client to initiate the data connection to the server reaches the FW, the packet matches the server map entry and is no longer controlled by the security policy.

<sysname> display firewall server-map
Type: ASPF, 1.1.1.1 -> 2.2.2.2:yyyy, Zone: ---
   Protocol: tcp(Appro: ftp-data), Left-Time: 00:00:15
   VPN: public -> public

<sysname> display firewall session-table
Current Total Sessions : 2
  ftp  VPN:public --> public 1.1.1.1:xxxx+->2.2.2.2:21
  ftp-data  VPN:public --> public 1.1.1.1:aaaa-->2.2.2.2:yyyy

ALG in FTP active mode

As shown in Figure 3, a client resides on the intranet, and a server on the Internet. To enable the client to properly access the server, configure a source NAT policy on the FW to translate the private address of the client into a public address and allow port translation. After the client and server establish a control channel through TCP three-way handshake, the client sends a private address and an open private network port to the server through the PORT command to establish a data channel.

Figure 3 ALG in FTP active mode

After ALG is configured, the FW analyzes the application-layer information of the PORT command, translates the private address and private network port carried in the command into the public address and public network port, forwards them to the server, and creates a server map. The server initiates a data connection to the translated public address and public network port. After the packet reaches the FW, the packet matches the server map entry, automatically translates the destination address and port into the actual private address, and is no longer controlled by the security policy.

Common NAT translates only transport-layer information of packets, and ALG can also translate application-layer information of packets.

If ALG is configured, you need only to configure the security policy from any port of the client to port 21 of the server on the FW.

<sysname> display firewall server-map
Type: ASPF, 1.1.1.1 -> 1.1.1.2:zzzz[192.168.0.1:yyyy], Zone: ---
   Protocol: tcp(Appro: ftp-data), Left-Time: 00:00:15
   VPN: public -> public

<sysname> display firewall session-table
Current Total Sessions : 2
  ftp  VPN:public --> public 192.168.0.1:xxxx[1.1.1.2:2050]+->1.1.1.1:21
  ftp-data  VPN:public --> public 1.1.1.1:20-->1.1.1.2:zzzz[192.168.0.1:yyyy]

ALG in FTP passive mode

As shown in Figure 4, a client resides on the Internet, and a server on the intranet. To enable the client to properly access the server, configure NAT Server on the FW to translate the public address of the server into a private address and allow port translation. After the client and server establish a control channel through TCP three-way handshake, the server sends a private address and an open private network port to the client through the PASV Command OK command to establish a data channel.

Figure 4 ALG in FTP passive mode

After ALG is configured, the FW analyzes the application-layer information of the PASV Command OK command, translates the private address and private network port carried in the command into the public address and public network port, forwards them to the client, and creates a server map. The client initiates a data connection to the translated public address and public network port. After the packet reaches the FW, the packet matches the server map entry, automatically translates the destination address and port into the actual private address, and is no longer controlled by the security policy.

If ALG is configured, you need only to configure the security policy from any port of the client to port 21 of the server on the FW.

Common NAT translates only transport-layer information of packets, and ALG can also translate application-layer information of packets.

If ALG is configured, you need only to configure the security policy from any port of the client to port 21 of the server on the FW.

<sysname> display firewall server-map
Type: ASPF, 1.1.1.1 -> 1.1.1.2:zzzz[192.168.0.1:yyyy], Zone: ---
   Protocol: tcp(Appro: ftp-data), Left-Time: 00:00:15
   VPN: public -> public

<sysname> display firewall session-table
Current Total Sessions : 2
  ftp  VPN:public --> public 1.1.1.1:xxxx+->1.1.1.2:22[192.168.0.1:21]
  ftp-data  VPN:public --> public 1.1.1.1:aaaa-->1.1.1.2:zzzz[192.168.0.1:yyyy]