> Source: [sk181165](https://support.checkpoint.com/results/sk/sk181165) # sk181165 - FTP connection fails in Port Mode with NAT and Specific FTP clients | Property | Value | |----------|-------| | Solution ID | sk181165 | | Date Created | 2023-07-23 | | Last Modified | 2025-01-20 | | Technical Level | General | | Products | Security Gateway | | Versions | R81.20, R81.10 (EOS), R81 (EOS) | ## Symptoms - * FTP connection fails when all these conditions are met: - Specific FTP Client Software (in this case, ROS3 FTP Client) - Port Mode - NAT * The firewall drops the port commands "PORT 10,10,198,200,148,247" from the FTP client. ``` FTP command sequence --------------------------------------- 220 Welcome to blah FTP service. USER root 331 Please specify the password. PASS asgent1 230 Login successful. TYPE I 200 Switching to Binary mode. PORT 10,10,198,200,148,247 <-- dropped by firewall --------------------------------------- ``` * The Kernel debug results show that the "PORT" command from the FTP client is dropped because of "fw_xlate_scan_ftp_cmd: bad termination format ('(');". ``` --------------------------------------- @;63553938;19May2023 15:06:07.557825;[cpu_2];[fw4_1];fw_xlate_anticipate_cookie: dir = 0, host = 100.100.100.100, port = 94f7, case = 1, is_cmi_fw_handler_streaming = 0; @;63553938;19May2023 15:06:07.557832;[cpu_2];[fw4_1];fw_xlate_scan_ftp_cmd: : PORT 10,10,198,200,148,247; @;63553938;19May2023 15:06:07.557833;[cpu_2];[fw4_1];fw_xlate_scan_ftp_cmd: PORT command; @;63553938;19May2023 15:06:07.557834;[cpu_2];[fw4_1];fw_xlate_scan_ftp_cmd: bad termination format ('('); @;63553938;19May2023 15:06:07.557835;[cpu_2];[fw4_1];fw_xlate_anticipate_cookie: fw_xlate_scan_ftp_cmd failed; @;63553938;19May2023 15:06:07.557836;[cpu_2];[fw4_1];fw_post_vm_chain_handler: handler function returned action DROP; @;63553938;19May2023 15:06:07.557841;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 10.10.198.200:47492 -> 192.168.198.200:8021 dropped by fw_post_vm_chain_handler Reason: Handler 'ftp_code' drop; @;63553938;19May2023 15:06:07.557846;[cpu_2];[fw4_1];After POST VM: 192.168.198.200:8021 IPP 6> (len=78) TCP flags=0x18 (PUSH-ACK), seq=885278701, ack=2403950228, data end=885278727 ; @;63553938;19May2023 15:06:07.557847;[cpu_2];[fw4_1];POST VM Final action=DROP; --------------------------------------- ``` ## Cause Some FTP clients send the command string fragmented: the first packet has the string of PORT command, and the next packet has \ (Carriage Return, Line Feed : "\\r\\n") Security Gateway expects to receive \(\\r\\n) at the end of every string. Therefore, the packet without the \(\\r\\n) is considered as of incorrect format and dropped. ## Solution This problem was fixed. The fix is included in: * [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127) * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 43 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 113 * [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 89 * [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211 If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content