Ftp Alg Hybrid Mode - D-Link DFL-260E User Manual

6.2.3. The FTP ALG
Connection Restriction Options
The FTP ALG has two options to restrict which type of mode the FTP client and the FTP server can
use:
• Allow the client to use active mode.
If this is enabled, FTP clients are allowed to use both passive and active transfer modes. With
this option disabled, the client is limited to using passive mode. If the FTP server requires active
mode, the NetDefendOS FTP ALG will handle the conversion automatically to active mode.
A range of client data ports is specified with this option. The server will be allowed to connect to
any of these if the client is using active mode. The default range is 1024-65535.
• Allow the server to use passive mode.
If this option is enabled, the FTP server is allowed to use both passive and active transfer modes.
With the option disabled, the server will never receive passive mode data channels.
NetDefendOS will handle the conversion automatically if clients use passive mode.
A range of server data ports is specified with this option. The client will be allowed to connect to
any of these if the server is using passive mode. The default range is 1024-65535.
These options can determine if hybrid mode is required to complete the connection. For example, if
the client connects with passive mode but this is not allowed to the server then hybrid mode is
automatically used and the FTP ALG performs the conversion between the two modes.
Predefined FTP ALGs
NetDefendOS provides four predefined FTP ALG definitions, each with a different combination of
the client/server mode restrictions described above.
• ftp-inbound - Clients can use any mode but servers cannot use passive mode.
• ftp-outbound - Clients cannot use active mode but servers can use any mode.
• ftp-passthrough - Both the client and the server can use any mode.
• ftp-internal - The client cannot use active mode and the server cannot use passive mode.
FTP ALG Command Restrictions
The FTP protocol consists of a set of standard commands that are sent between server and client. If
the NetDefendOS FTP ALG sees a command it does not recognize then the command is blocked.
This blocking must be explicitly lifted and the options for lifting blocking are:
• Allow unknown FTP commands. These are commands the ALG does not consider part of the
standard set.
Figure 6.3. FTP ALG Hybrid Mode
Note: Hybrid conversion is automatic
Hybrid mode does not need to enabled. The conversion between modes occurs
automatically within the FTP ALG.
251
Chapter 6. Security Mechanisms