Stateful packet inspection combines stateful filtering with access to application-level commands, which secure protocols such as FTP.
FTP involves two connections: control for commands and data for the information. When a client connects to an FTP server:
The control channel is established on FTP destination port 21.
An entry is made in the state table.
If Use FTP protocol inspection is enabled, the firewall performs stateful packet inspection on packets arriving through the FTP control channel on port 21.
With the control channel open, the client communicates with the FTP server. The firewall parses the PORT command in the packet and creates a second entry in the state table to allow the data connection.
When the FTP server is in active mode, it opens the data connection; in passive mode, the client initiates the connection. When the FTP server receives the first data transfer command (LIST), it opens the data connection toward the client and transfers the data. The data channel is closed after the transmission is completed.
The combination of the control connection and data connections is called a session. FTP dynamic rules are sometimes called session rules. The session remains established until its control channel entry is deleted from the state table. During the periodic cleanup of the table, if a session’s control channel has been deleted, all data connections are then deleted.