Passive FTP using FTP profile

Hi Daniel,

First thanks for share this information with me.

I duplicate your configs, just to prevent missconfigurations.

Here is my config.

admin@(TESTING01)(cfg-sync Standalone)(Active)(/Common)(tmos)# list ltm profile ftp ftp
ltm profile ftp ftp {
    app-service none
}

FTP config

listen=NO
listen_ipv6=YES
local_enable=NO
anonymous_enable=YES
write_enable=NO
anon_root=/ftp/test
xferlog_enable=YES
dual_log_enable=YES
log_ftp_protocol=YES
vsftpd_log_file=/ftp/logs/vsftpd.log
xferlog_file=/ftp/logs/xferlog.log
pasv_min_port=40000
pasv_max_port=40200
anon_umask=022
banner_file=/etc/vsftpd/banner.txt

VIP config ( config not listed below has been kept as default)

source address: any
destination address: any
Service Port: 21 ftp
Protocol: tcp
ftp profile: ftp
Vlan and Tunnel traffic: all VLANs and tunnels
Source Address Translation: auto map
Address translation: enabled
port translation: enabled
Default Pool: FTP POOL

I've created an FTP monitor that retrieves a file on the ftp server , attach it to the ftp pool and its working ok.

The issue start when a remote source (whitelisted to access) connects to the FTP using the F5 public ip, everything looks good until the remote source request PASV

if my ftp pool member is configured with it Public IP, the error recieved after PASV is

421 Service not available, remote server has closed connection
Passive mode refused.

If my FTP pool member is configured using its private IP, the client receives ( "227 Entering Passive Mode (private VIP ip , Ephemeral Port ")

obviously can not be resolved by the remote source.

I downloaded an Irule that i found in this forum, that preserve ephemeral ports and i modified it to sent (no matter what) the public IP of the F5 when pasv is requested ( keeping the ephemeral port as it is) but again "passive mode refused" )

I've tried another combinations like use "pasv_address" on the ftp server, pointing to the F5 public & private IP, but only works if I point to Public Ip Address of the F5 and remove the ftp profile from the VIP.

I checked this further and I cannot find any difference. I checked if I missed something in my vsftpd.conf... nope.

Your VS config seems OK, too. Can you check for the destination 0.0.0.0:0 (any) and the iRule? That seems off....

In my Wireshark capture it looks like this:

vsftp server ----> floating self-IP >> ftp.passive.ip==<IP address of the vsftp server>
virtual server ----> client >> ftp.passive.ip==<IP address of the F5 virtual>

So the value for ftp.passive.ip get's updated and replaced properly.

I tried with FileZilla and WinSCP, no special config required there either. Just works.