Description

This article provides information on how to configure FTP with a Custom Control Port (other than 21).

Symptoms

Environment :
  • FTP using non-standard control port
  • Custom ALG

Solution

By default, the FTP ALG looks for sessions with the 21 destination port; based on that, it performs ALG processing for FTP. However, if you try FTP with some other custom port, it will not perform ALG processing; as the original FTP session was not present on the custom port. If you want to use FTP on port 2100 for FTP ALG processing, define a custom application by specifying the application-protocol FTP.

Note : This configuration syntax is applicable to Junos 10.4 or later.

Example : 

root@rng# show applications 
application ftp-2100 {
    application-protocol ftp;
    protocol tcp;
    destination-port 2100;
}
When the custom application is defined, the security policy can be configured to use the application ftp-2100 and it will perform FTP ALG processing; based on the control session with the 2100 destination port. 
root@rng# show security policies from-zone untrust to-zone GuestNet 
policy in-ftp {
    match {
        source-address any;
        destination-address ftp-server;
        application ftp-2100;
    }
    then {
        permit;
    }
}

Modification History

2020-09-26 - Article verified for accuracy. Article is valid and accurate