> Source: [sk171375](https://support.checkpoint.com/results/sk/sk171375)

# sk171375 - Passive mode FTP connection fails with "Passive reply (227) received while working in Active mode"

| Property | Value |
|----------|-------|
| Solution ID | sk171375 |
| Date Created | 2021-06-02 |
| Last Modified | 2021-09-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * The Security Gateway log shows that it rejected the FTP traffic with the message below, and that the service matched is ftp-port (TCP/21) rather than ftp-pasv or ftp.  

  ```
  Passive reply (227) received while working in Active mode
  ```

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk171375/ftp-port reject202101032002551.png)   

  <br />

* 
  The client side's traffic capture or FTP client log shows that the private IP appears in the PASV reply from the FTP server.  

  ```
  
  Command:	PASV
  
  Response:	227 Entering Passive Mode (192,168,2,21,XXX,XXX)
  
  Command:	MLSD
  
  Response:	425 Can't open data connection for transfer of "/"
  
  Error:	Failed to retrieve directory listing
  
  ```

  <br />

* The FTP server cannot retrieve directory listings and transfer files.

  <br />

## Cause

Multiple configured FTP services in the same rule allow the connections to the FTP server. This causes an issue where the Security Gateway chooses an incorrect protocol handler to deal with the Passive mode FTP connection:  

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk171375/ftp-services202101031947272.png)

<br />

## Solution

Remove all FTP services from the rule and use only**ftp** service. If you want only to use Passive mode FTP, use only **ftp-pasv** service in the rule. (In addition, this applies if you do not use multiple services with the same port in the same rule.)  

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk171375/ftp-rule202101031947061.png)

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content