Why do firewalls need to specially treat an active mode FTP session?
Click on the arrows to vote for the correct answer
A. B. C. D.A.
FTP (File Transfer Protocol) is a widely used protocol for transferring files over the internet. It uses two channels: a control channel for sending commands and responses between the client and server, and a data channel for transferring the actual file data.
In active mode FTP, the client initiates both the control and data connections. The client sends a PORT command to the server, which tells the server the IP address and port number to use for the data connection. The server then initiates the data connection to the client on that IP address and port number.
Firewalls need to specially treat active mode FTP sessions because the data channel is originating from the server side, which means that the server is initiating the connection to the client. This can cause problems for firewalls because they typically block incoming connections by default for security reasons.
To allow the data connection in an active mode FTP session to pass through the firewall, the firewall needs to dynamically open a hole in its security policy to allow the incoming data connection from the server. This is known as a dynamic access policy or dynamic ACL (Access Control List). The firewall needs to inspect the control channel traffic to identify the IP address and port number that the server will use for the data channel, and then create a temporary ACL rule to allow that traffic to pass through the firewall.
If the FTP client opens too many concurrent data connections or if the FTP server sends chunks of data that are too big, it can also cause problems for firewalls. In these cases, the firewall may need to limit the number of concurrent data connections or the size of the data chunks to prevent excessive traffic that could overload the firewall or cause it to drop packets.
Finally, the option D. "The data channel is using a 7-bit transfer mode" is not a valid reason why firewalls need to specially treat active mode FTP sessions, as FTP data channels use binary mode by default, which transfers 8-bit data.