> Source: [sk112001](https://support.checkpoint.com/results/sk/sk112001)

# sk112001 - Passive mode FTP connection fails 

| Property | Value |
|----------|-------|
| Solution ID | sk112001 |
| Date Created | 2016-06-29 |
| Last Modified | 2022-07-24 |
| Technical Level | Advanced |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 1500, 1600, 1800, 910 |

## Symptoms

- * When the user connects to an FTP server that is behind a 600/700 appliance, the connection is successful but can't list or transfer files.   

* The `fw ctl zdebug drop` debug shows:   

  `;[fw4_0];fw_log_drop_ex: Packet proto=6 x.x.x.x:21 -> x.x.x.x:59348 dropped by fw_conn_post_inspect Reason: Handler 'ftp_code' drop;`  

* FTP client shows logs:   

  ```
  
  Status:	Server sent passive reply with unroutable address. Using server address instead.
  Command:	MLSD
  Error: The data connection could not be established: ECONNREFUSED - Connection refused by server
  ```

## Cause

When the passive mode is initiated in an FTP-over-TLS connection, the packets are sent encrypted. Since the Security Gateway is not a peer in the communication, it is not able to replace the server's IP address with its own because of the encryption, and so the packet is sent unchanged. The client obtains the server's real IP address, which is hidden behind the Security Gateway and is unroutable from the Internet.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content