Yes this is a (global) problem, even with the latest checkpoint firewalls. What happens with active FTP, is that each command (get, list etc.) will cause the client to open another session (source port) to the server on port 21. If you run netstat from the client you can check this out for yourself.
What normally happens with HTTP, FTP, telnet what have ya, is that the client establishes a connection to port 21, 23 etc. and then returns with a source port such as 1936, 1980, 3000 etc.
Problem with statefull connect firewalls is that they do not allow multiple control sessions over one destination port number, so only one source port can be linked to a destination port, in this case 21 for FTP. I don´t see it changed any time soon, since it´s an extreme security risk, someone else might be hopping along the session, and blocking that type of traffic is what stateful firewalls are all about, and FTP servers are problably the most hacked machines on the planet.
You´ve mentioned the workaround, unfortunately that´s the only way, change your clients to passive, I believe Unix/Linux clients have a problem with this, changing your FTP server might also help, there are several servers which can be configured to disable active FTP, I wouldn´t know exactly, I only do networks & firewalls... maybe someone else can tip on this...
