ftp-proxy explicit

Use this command to enable the explicit FTP proxy, and configure the TCP port used by the explicit FTP proxy.

config ftp-proxy explicit
    set status {enable | disable}   Enable/disable the explicit FTP proxy.
    set incoming-port {string}   Accept incoming FTP requests on one or more ports.
    set incoming-ip {ipv4 address any}   Accept incoming FTP requests from this IP address. An interface must have this IP address.
    set outgoing-ip {ipv4 address any}   Outgoing FTP requests will leave from this IP address. An interface must have this IP address.
    set sec-default-action {accept | deny}   Accept or deny explicit FTP proxy sessions when no FTP proxy firewall policy exists.
            accept  Accept requests. All explicit FTP proxy traffic is accepted whether there is an explicit FTP proxy policy or not
            deny    Deny requests unless there is a matching explicit FTP proxy policy.
end

Additional information

The following section is for those options that require additional explanation.

status

Enable/disable the explicit FTP proxy for FTP sessions.

incoming-port

Enter the port number that traffic from FTP clients use to connect to the explicit FTP proxy. The range is 0 to 65535. Explicit FTP proxy users must configure their FTP client proxy settings to use this port.

Default value: 21

incoming-ip

Enter the IP address of a FortiGate unit interface that should accept sessions for the explicit FTP proxy. Use this command to restrict the explicit FTP proxy to only accepting sessions from one FortiGate interface.

The destination IP address of explicit FTP proxy sessions should match this IP address.

This field is visible in NAT mode only.

outgoing-ip

Enter the IP address of a FortiGate unit interface that explicit FTP proxy sessions should exit the FortiGate unit from. Use this command to restrict the explicit FTP proxy to only allowing sessions to exit from one FortiGate interface.

This IP address becomes the source address of FTP proxy sessions exiting the FortiGate unit.

This field is visible in NAT mode only.

sec-default-action

Configure the explicit FTP proxy to block (deny) or accept sessions if firewall policies have not been added for the explicit FTP proxy. To add firewall policies for the explicit FTP proxy add a firewall policy and set the source interface to ftp-proxy.

The default setting denies access to the explicit FTP proxy before adding a firewall policy. If you set this option to accept the explicit FTP proxy server accepts sessions even if you haven’t added an ftp-proxy firewall policy.