FTP connection failed through SRX due to PASV IP mismatch
topology: FTP client ----- SRX ---- VSFTP server
FTP client stuck in 'awaiting response' status while connecting to FTP server through SRX with ALG FTP enabled.
SNAT and DNAT was configured on SRX to translate the FTP traffic from FTP client:
SNAT: x.x.x.x → y.y.y.y
DNAT: a.a.a.a → b.b.b.b
After comparing the working and non-working FTP connections through the same SRX with similar configurations, it was found that for the non-working case, the pasv_address (a.a.a.a) in 227 response mismatched the real IP of the FTP server(b.b.b.b). FTP control sessions were closed by junos-tcp-clt-emul（Junos TCP Client Emulator). FTP data session was unable to be established by FTP ALG due to the failed consistency check between pasv_address and server IP.
when FTP ALG is enabled, in passive mode, consistency check is necessary in 227 response. If the pasv_address configured in server (also the one included in 227 response with output like: 227 Entering Passive Mode (a.a.a.a,n,m)) is not the same one as the source IP (real server IP) of the packet, FTP ALG would consider it as an abnormal response or possible packet tampering and stop further processing of creating the pinhole for data session. Therefore, client stuck in ''awaiting response" status and could never succeed in file transfer as data session is not established.
A sample of failed FTP process due to this issue:
Frame 4: 220 (vsFTPd 3.0.2)
Frame 6: USER xxx
Frame 8: 331 Please specify the password.
Frame 10: PASS xxx
Frame 11: 230 Login successful.
Frame 13: SYST
Frame 14: 215 UNIX Type: L8
Frame 16: CWD /
Frame 17: 250 Directory successfully changed.
Frame 19: PASV
Frame 20: 227 Entering Passive Mode (10,253,72,159,39,84).
Frame 21: ACK <<------no FTP data session for file transfer
Sample ALG trace logs for failed FTP access due to this issue:
Jul 22 15:50:00 15:49:59.964515:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: FTP Control Message: PASV
Jul 22 15:50:00 15:49:59.964516:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE ftp_set_state:1110
Jul 22 15:50:00 15:49:59.964516:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: Set state to 1
Jul 22 15:50:00 15:49:59.964517:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE ftp_get_state:304
Jul 22 15:50:00 15:49:59.964517:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE ftp_trans_cmd_if_natpt:1282
Jul 22 15:50:49 15:50:49.656272:CID-0:THREAD_ID-14:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_ftp_alg_data_handler:3554
Jul 22 15:50:49 15:50:49.656274:CID-0:THREAD_ID-14:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_alg_ftp_sess_close_check_handler:3106
Jul 22 15:50:49 15:50:49.656276:CID-0:THREAD_ID-14:LSYS_ID-00:RT:[ALG_FTP] INFO: Control session close check, OK.
Sample ALG trace for successful FTP access:
Jul 22 16:24:13 16:24:12.961114:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: FTP Control Message: PASV
Jul 22 16:24:13 16:24:12.961114:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE ftp_set_state:1110
Jul 22 16:24:13 16:24:12.961115:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: Set state to 1
Jul 22 16:24:13 16:24:12.961115:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE ftp_get_state:304
Jul 22 16:24:13 16:24:12.961116:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE ftp_trans_cmd_if_natpt:1282
Jul 22 16:24:13 16:24:12.961805:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_ftp_alg_data_handler:3554
Jul 22 16:24:13 16:24:12.961806:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_alg_ftp_gate_hit_handler:3300
Jul 22 16:24:13 16:24:12.961807:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_alg_ftp_is_ftps_control_session:2926
Jul 22 16:24:13 16:24:12.961833:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: jsf_asl_process_gate_hit OK.
Jul 22 16:24:13 16:24:12.961884:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_ftp_alg_data_handler:3554
Jul 22 16:24:13 16:24:12.961884:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_alg_ftp_sess_interest_handler:2878
Jul 22 16:24:13 16:24:12.961912:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_ftp_alg_data_handler:3554
Jul 22 16:24:13 16:24:12.961912:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: ALG FTP TRACE jsf_alg_ftp_sess_create_handler:3058
Jul 22 16:24:13 16:24:12.961916:CID-0:THREAD_ID-17:LSYS_ID-00:RT:[ALG_FTP] INFO: Data session created sid=7809.
Workaround: configure 'set security alg ftp allow-mismatch-ip-address' to ignore the ip mismatch
Fix: change pasv_address value on FTP server to match the real IP
https://www.juniper.net/documentation//us/en/software/junos/alg/topics/topic-map/security-ftp-alg.html