Resolution
There are two modes in FTP:
- Active FTP The PIX Firewall inspects the traffic and allows the outside server to open the data channel as long as the fixup protocol ftp command is enabled.
- Passive FTP The client opens both channels, ftp and ftp-data.
The PIX cannot fix the secure FTP connections. When the data channel is opened with the port command, the PIX does not understand it since those commands are already encrypted and cannot dynamically open the ports for the data channel.
In order to make secure FTP work, restrict the range of ports on the secure FTP server (for the data channel) and then open up those ports on the outside interface.
