Is ftp a one or two way communication? If I need to allow it outbound through a firewall is it enough if I allow it from inside to outside or does it need to be bidirectional?

What about SFTP?


  • Are you speaking about a client on the inside connecting to an FTP/SFTP server on the outside? Or the reverse, hosting an FTP/SFTP server on the inside? Aug 15, 2014 at 18:47
  • server sitting inside and its uploading data via ftp/sftp to the client which is on the outside
    – user3916
    Aug 15, 2014 at 18:55
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8, 2017 at 21:46

1 Answer 1


Since your comment indicated the client is on the outside and the server sitting inside, the outside client would be initiating a connection to your inside server. Therefore, your firewall must have an ACL on your outside interface to permit this, but this is just the beginning of the story....


FTP has a control channel on port 21 and a data channel on port 20 by default, but the data channel is usually some random port negotiated over the control channel. With a firewall like the Cisco ASA or PIX, you typically need FTP Inspection enabled. Your Outside ACL only allows tcp/21. The Inspection occurs at the FTP app layer so the firewall can detect the port for the data channel and create a pinhole for that traffic.

The data transfers take place on the data channel in either Active or Passive mode as determined by the client. [Active mode was once the predominant default, but many clients are moving to Passive now.] Active mode (FTP PORT command) indicates the port (and IP address) the client is listening for the incoming data connection initiated by the server. This often breaks because client firewalls are not often capable of the Inspection-equivalency to let that through. So often, we see clients doing Passive mode (FTP PASV command) which asks the server to provide a port that the client will connect to (server listening on PASV port).

Without Inspection or its equivalent on your firewall, you'll need to open blocks of ports if clients are Passive and restrict your server to a small range of data channel ports. Keeping the number of ports low prevents you from opening too many ports on your Outside ACL. With Active clients and no Inspection, a default permit inside any any type of statement would let your server initiate a connection out to the client on the data channel, though you may still run into the client's firewall getting in the way as described earlier.


This is just Secure (or SSH) FTP which is really just SSH file transfers and not the FTP protocol itself. It defaults to tcp/22 -- same as SSH -- and doesn't require a separate channel. This is much easier to handle through firewalls, but obviously both client and server need to be speaking the same protocol.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.