> Source: [sk45085](https://support.checkpoint.com/results/sk/sk45085)

# sk45085 - FTP connection in Passive Mode does not work after configuring Anti-Virus Blade to scan FTP traffic

| Property | Value |
|----------|-------|
| Solution ID | sk45085 |
| Date Created | 2010-07-01 |
| Last Modified | 2020-07-08 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * FTP connection in Passive Mode does not work after configuring Anti-Virus Blade to scan FTP traffic.

* Kernel debug ('`fw ctl debug -m fw + drop packet`') shows:

  ```
  
  [-- Stateful VM inbound: Entering (...) --] 
  Before VM: <...> (len=...) TCP flags=0x18 (PUSH-ACK), seq=..., ack=..., data end=... (ifn=N) (first seen) (looked up) 
  fw_conn_post_inspect: executing handler function ftp_code 
  fw_ftpport:not requiring newline 
  fw_do_ftpport: data = 227 Entering Passive Mode (1st_octet_of_Dec_IP_of_FTP_Server,2nd_octet_of_Dec_IP_of_FTP_Server,3rd_octet_of_Dec_IP_of_FTP_Server,4th_octet_of_Dec_IP_of_FTP_Server,Value_1,Value_2))
  
  fw_do_ftpport: 227 command 
  fw_do_ftpport: command OK, port = Dec_Port_of_FTP_Client (Value_1,Value_2) 
  fwconn_lookup_other: conn <0,Hex_IP_of_FTP_Server,Hex_Port_of_FTP_Client,Hex_IP_of_FTP_Client,0,6> 
  not found in connections table 
  fwconn_lookup_other: conn <1,Hex_IP_of_FTP_Client,Hex_Port_of_FTP_Client,Hex_IP_of_FTP_Server,15,6;...>
  found in connections table 
  fw_xlate_scan_ftp_cmd: bad termination format (')') 
  fw_conn_post_inspect: handler function returned action DROP 
  fw_log_drop: Packet proto=6 Dec_IP_of_FTP_Server:21 -> Dec_IP_of_FTP_Client:Dec_Port_of_FTP_Client dropped by fw_conn_post_inspect Reason: Handler 'ftp_code' drop 
  After VM: <Hex_IP_of_FTP_Server,15,Hex_IP_of_FTP_Client,Hex_Port_of_FTP_Client,6> (len=...) TCP flags=0x18 (PUSH-ACK), seq=..., ack=..., data end=...
  VM Final action=DROP 
  ----- Stateful VM inbound Completed -----
  ```

## Cause

Anti-Virus FTP scan causes 227 Passive Mode responses from the FTP Server to be dropped when using a non-RFC compliant termination with double parentheses "))".

Instead of sending the following response format:   
227 Entering Passive Mode (h1,h2,h3,h4,p1,p2**)** .   

It sends the following response format (with an extra closing parenthesis):   
227 Entering Passive Mode (h1,h2,h3,h4,p1,p2**))**

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content