FTP permitted by default

[Gbgreat]

I have a server on my DMZ that runs a service on FTP.

I do not have an access-list permitting traffic from outside to the DMZ on ftp.

FTP is not inspected on the global policy

But the FTP service is accessible from the outside network.

Is there any reason? and how can this be stopped.

Also note an access list has been configured to deny, however it still persist.

[GRANT3779]

Is this a publicly accessible server that sits on the DMZ via NAT?

We would really need to see some config otherwise it would all be guess work.

Some questions.. 

What are the security levels on the interfaces? 

You mention a deny ACL also.

Does this reference real/mapped address if NATd?

What interface and what direction is the ACL applied. 

Most helpful would be source / destination IP and config output. 

[Mohammed al Baqari]

What is the security level assigned to dmz and outside interface. Most
likely outside security is higher than dmz. Or they are same and
same-security inter interface is enabled.

[Martin L]

disable it/ block it