HP 6600 Security Configuration Manual page 463

Figure 228 Network diagram for ALG-enabled FTP application in passive mode
Inside network
FTP server
FTP_CMD ("PASV")
FTP_EnterPassive ("IP1, Port1")
FTP_Connet (IP1, Port1)
The communication process includes the following steps:
1. Establishing a control connection.
The host sends a TCP connection request to the server. If a TCP connection is established, the server
and the host enter the user authentication stage.
2. Authenticating the user.
The host sends the server an authentication request, which contains the FTP commands (user and
password) and the contents.
When the request passes through the ALG-enabled device, the commands in the payload of the
packet are resolved and used to check whether the protocol state transition is correctly proceeding.
If not, the request will be dropped. In this way, ALG protects the server against clients that send
packets with state errors or log in to the server with unauthorized user accounts.
An authentication request with the correct state is forwarded by the ALG-enabled device to the
server, which authenticates the host according to the information in the packet.
3. Establishing a data connection.
If the host passes the authentication, a data connection is established between it and the server. If
the host is accessing the server in passive mode, the server sends the host a PASV response that
uses its private network address and port number (IP1, Port1). When the response arrives at the
ALG-enabled device, the device resolves the packet and translates the server's private network
address and port number into the server's public network address and port number (IP2, Port2)
respectively. Then, the device uses the public network address and port number to establish a data
connection with the host.
4. Exchanging data.
The host and the FTP server exchange data through the established data connection.
NAT
Router
FTP-ALG enabled
FTP_CMD ("PASV")
ALG
IP1, Port1------- IP2, Port2
>
FTP_EnterPassive ("IP2, Port2")
FTP_Connet (IP2, Port2)
449
Outside network
Host