It is my understanding that NBAR is able to classify certain packets based on certain descriptors in the packet. It is also my understanding that the FTP client and server negotiate different port numbers once the session is initiated. I have enable NBAR protocol discovery on all ports and Debug NBAR unclassified port stats. Once the session is initiated all FTP traffic is classified as unknown with different port numbers. I have also tried using extended access lists to match some traffic but it only sees the initial traffic.
How can I classify FTP traffic coming into my router from the internet?
Are you using NAT or TCP Intercept feature on the same router? I have had experiences when mixing these features with the NBAR that it did not work as expected. The NAT or TCP Intercept modify the original packet's header fields, thereby wreaking havoc with the NBAR. I have even made a note to myself that when the NBAR was enabled on a "NAT inside" interface, it was not able to properly classify the FTP flows which may well be the issue you are experiencing yourself.
Thanks for the heads up but unfortunately I was setting this up in a lab environment to rollout at a customer site and this was setup without NAT or TCP intercept.
Can you perhaps provide us with the following information?