| 12.1 |  | Advanced Protocols |
| 12.1.3 |  | FTP fixup configuration |

| The first protocol that will be examined is FTP. Students will learn how FTP functions, how it interacts with the PIX, and how the PIX can be configured to resolve any compatibility issues that exist between itself and FTP. In the case of FTP, there are two separate modes that interact differently with the PIX. These modes, standard and passive, are explained below.

Standard mode FTP
Standard mode FTP uses two channels for communications . When a client starts an FTP connection, a standard TCP channel is opened from one of the high-order ports of the client to port 21 on the server. This is referred to as the command channel.

When the client requests data from the server, it tells the server to send the data to a given high-order port. The server acknowledges the request and initiates a connection from its own port 20 to the high-order port that the client specified. This is referred to as the data channel.

The server initiates the connection to the requested client port. This made it difficult to have firewalls permit a data channel to the client without permanently opening port 20 connections from external servers to internal clients for outbound FTP connections. This created a potential vulnerability by exposing clients on the inside of the firewall. Fortunately, protocol fix ups have resolved this problem.

For FTP traffic, the PIX Security Appliance behaves differently for outbound or inbound connections in the following manner:

- With outbound connections, when the client requests data, the PIX Security Appliance opens a temporary inbound conduit for the data channel from the server. It is important to note that this conduit is torn down after the data is sent.
- Inbound connections are handled differently depending on whether outbound TCP traffic is allowed.

- If a conduit exists allowing inbound connections to an FTP server, and if all outbound TCP traffic is implicitly allowed, no special handling is required because the server initiates the data channel from the inside.
- If a conduit exists allowing inbound connections to an FTP server, and if all outbound TCP traffic is not implicitly allowed, the PIX Security Appliance opens a temporary conduit for the data channel from the server. This conduit is torn down after the data is sent.

The example shown in Figure illustrates how the FTP client and server communicate across the command and data channels when FTP is operating in standard mode. Notice how the server initiates the data channel.

Passive mode FTP
Like standard mode FTP, passive mode FTP (PFTP) also uses two channels for communications . The difference between the two modes is that the data channel setup works differently. With PFTP, when the client requests data from the server, it asks the server if it accepts PFTP connections. If the server accepts PFTP connections, it sends the client a high-order port number to use for the data channel. The client then initiates the data connection from its own high-order port to the port that the server sent.

Because the client initiates both the command and data connections, early firewalls could easily support outbound connections without exposing inside clients to attack. However, inbound connections proved to be more of a challenge. Again, the FTP protocol fixup resolved this issue.

For PFTP traffic, the PIX Security Appliance behaves differently for outbound or inbound connections in the following manner:

- Outbound connections are handled differently depending on whether outbound TCP traffic is allowed.

- If all outbound TCP traffic is implicitly allowed, no special handling is required because the client initiates both the command and data channels from the inside.
- If all outbound TCP traffic is not implicitly allowed, the PIX Security Appliance opens a temporary conduit for the data channel from the client. This conduit is torn down after the data is sent.

- Inbound traffic is handled depending on whether a conduit exists allowing inbound connections to a PFTP server. If a conduit exists, the client requests are allowed and the PIX Security Appliance opens a temporary inbound conduit for the data channel. This conduit is torn down after the data is sent.

The example shown in Figure illustrates how the FTP client and server communicate across the command and data channels when FTP is operating in passive mode. Notice how the client initiates the data channel.