Ftp Alg Hybrid Mode - D-Link NetDefendOS User Manual

other. This type of FTP ALG usage is sometimes referred to as hybrid mode.
The advantage of hybrid mode can be summarized as follows:
• The FTP client can be configured to use passive mode, which is the recommended mode for
clients.
• The FTP server can be configured to use active mode, which is the safer mode for servers.
• When an FTP session is established, the NetDefend Firewall will automatically and
transparently receive the passive data channel from the FTP client and the active data
channel from the server, and correctly tie them together.
This implementation results in both the FTP client and the FTP server working in their most
secure mode. The conversion also works the other way around, that is, with the FTP client using
active mode and the FTP server using passive mode. The illustration below shows the typical
hybrid mode scenario.
Note: Hybrid conversion is automatic
Hybrid mode does not need to enabled. The conversion between modes occurs
automatically within the FTP ALG.
Connection Restriction Options
The FTP ALG has two options to restrict which type of mode the FTP client and the FTP server can
use:
• Allow the client to use active mode.
If this is enabled, FTP clients are allowed to use both passive and active transfer modes. With
this option disabled, the client is limited to using passive mode. If the FTP server requires
active mode, the NetDefendOS FTP ALG will handle the conversion automatically to active
mode.
A range of client data ports is specified with this option. The server will be allowed to connect
to any of these if the client is using active mode. The default range is 1024-65535.
Figure 6.3. FTP ALG Hybrid Mode
437
Chapter 6: Security Mechanisms