> Source: [sk169993](https://support.checkpoint.com/results/sk/sk169993)

# sk169993 - Passive mode FTP connection fails with "Unable to Parse FTP PORT/227 command - header IP different from command IP"

| Property | Value |
|----------|-------|
| Solution ID | sk169993 |
| Date Created | 2020-12-19 |
| Last Modified | 2022-03-29 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * NAT rule for FTP service is configured on a Check Point Security Gateway and the FTP server login works correctly, but the data connection cannot be established.  

* The user cannot list the directory and transfer files through the FTP server.  

* The Security Gateway log shows that the FTP traffic is accepted with the following message:  

  ```
  Unable to Parse FTP PORT/227 command - header IP different from command IP
  ```

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk169993/sk169993202010211202341.png)  

* Another Security Gateway log of the data connection (high TCP port) from the client is dropped by the cleanup rule because there is no NAT rule matched.

## Cause

This is a configuration issue on the FTP server side. The external IP address is defined on the FTP server to use the NATed public IP address for the Passive mode reply.

## Solution

The Check Point Security Gateway monitors the FTP control connection (i.e., PORT and PASV commands) and performs NAT based on the rulebase.

The passive IP address given by the FTP server in the PASV reply should stay the same with the source IP address detected by the Check Point Security Gateway. Otherwise, the Security Gateway cannot perform NAT on the PASV reply and the TCP port cannot open automatically to accept the data connection from the FTP client.  

Do not configure the passive mode IP address on the FTP server for Plain FTP (unencrypted).

There is an example about how to change it on the FileZilla Server:  

1. Open the FileZilla Server Interface and connect to the server.  

2. Go to **Edit** \> **Settings** \> **Passive mode settings** .  

3. Choose the option **Default** under **External Server IP Address for passive mode transfers** and save the changes.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk169993/FileZilla_Passive_Mode202010101806311.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content