HP VSR1000 Security Configuration Manual page 299

Figure 83 FTP inspection
As shown in
1. The FTP client initiates an FTP control connection from port 1333 to port 21 of the FTP server.
2. As a result of negotiation, the server initiates a data connection from port 20 to port 1600 of the
client.
3. When data transmission times out or ends, the data connection is removed.
ASPF implements FTP inspection during the FTP connection lifetime:
1. ASPF checks the IP packets the FTP client sends to the FTP server to identify TCP-based FTP packets.
Based on the port number, ASPF determines whether the connection is the control connection
between the FTP client and server and, if yes, creates a session entry.
2. ASPF checks each FTP control connection packet, and detects their TCP status based on the session
entry. ASPF analyzes the FTP instructions. If the packet contains a data channel setup instruction,
ASPF creates associated entries for the data connection.
3. For returned FTP control connection packets, ASPF first matches these packets against the control
connection session entry, and then checks their TCP status to determine whether to permit the
packets to pass.
4. When the FTP data passes through the device, ASPF is triggered to create a session entry for the
data connection. The associated entry is removed.
5. For returned FTP data connection packets, ASPF matches these packets against the data
connection session entry, checks their TCP status, and determines whether to permit the packets to
pass.
6. When the data transmission ends, ASPF removes the data connection session entry. When the FTP
connection is removed, ASPF removes the control connection session entry.
Transport layer protocol inspection
The transport layer protocol inspection refers to generic TCP/UDP inspection. It creates session entries to
record the transport layer information of the packets, such as source and destination addresses and port
numbers, to dynamically filter packets.
Generic TCP/UDP inspection requires that return packets must match the corresponding packets that are
previously sent out of the external interface. The return packets must have the same source/destination
Figure 83, FTP connections are established and removed as follows:
289