SRX Admin configures transfer-on-commit and notices that the config archive to the remote FTP Server is not working.

On the FTP Archive server, the Temp file gets created (Zero Bytes size), but no data transfer is happening and finally the Temp file gets removed.

The archival config is conformed to be correct:

Sample Config:

set system archival configuration transfer-on-commit set system archival configuration archive-sites "ftp://user@host/path"

While taking a Flow trace it reveals that the data channel request on TCP Port 20 is getting dropped on SRX:

May 15 12:47:58 12:47:58.360645:CID-1:RT: flow_first_in_dst_nat: in <reth0.0>, out <N/A> dst_adr xxx.xxx.xxx.14, sp 20, dp 61344

May 15 12:47:58 12:47:58.360645:CID-1:RT: chose interface reth0.0 as incoming nat if.

May 15 12:47:58 12:47:58.360645:CID-1:RT: packet dropped: for self but not interested

May 15 12:47:58 12:47:58.360645:CID-1:RT: packet dropped, packet dropped: for self but not interested.

May 15 12:47:58 12:47:58.360849:CID-1:RT:flow_initiate_first_path: first pak no session

May 15 12:47:58 12:47:58.360849:CID-1:RT: flow find session returns error.

May 15 12:47:58 12:47:58.360849:CID-1:RT:flow_proc_rc: -1

May 15 12:47:58 12:47:58.360849:CID-1:RT: ---- flow_process_pkt rc 0x7 (fp rc -1)

This behavior where the FTP CTL channel traffic (TCP Port 21) is passing through and the FTP DATA channel (TCP Port 20) traffic is getting Dropped, strongly indicates that the FTP ALG is not active/enabld and hence the FTP Data Port is not opened.

The FTP ALG acts as an intelligent, protocol-aware intermediary inside the SRX flow forwarding engine. It intercepts the control channel and dynamically updates the firewall state for the data plane traffic.

Enable the FTP ALG for addressing this issue:

delete security alg ftp disable

show | compare

commit