Amer Networks E5Web GUI - Manual (Page 390)

certain control commands and provide buffer overrun protection.
Hybrid Mode
An important feature of the cOS Core FTP ALG is its automatic ability to perform on-the-fly
conversion between active and passive mode so that FTP connection modes can be combined.
Passive mode can be used on one side of the security gateway while active mode can be used on
the other. This type of FTP ALG usage is sometimes referred to as hybrid mode.
The advantage of hybrid mode can be summarized as follows:
• The FTP client can be configured to use passive mode, which is the recommended mode for
clients.
• The FTP server can be configured to use active mode, which is the safer mode for servers.
• When an FTP session is established, the Clavister Security Gateway will automatically and
transparently receive the passive data channel from the FTP client and the active data
channel from the server, and correctly tie them together.
This implementation results in both the FTP client and the FTP server working in their most
secure mode. The conversion also works the other way around, that is, with the FTP client using
active mode and the FTP server using passive mode. The illustration below shows the typical
hybrid mode scenario.
Figure 6.3. FTP ALG Hybrid Mode
Note: Hybrid conversion is automatic
Hybrid mode does not need to enabled. The conversion between modes occurs
automatically within the FTP ALG.
Connection Restriction Options
The FTP ALG has two options to restrict which type of mode the FTP client and the FTP server can
use:
• Allow the client to use active mode.
If this is enabled, FTP clients are allowed to use both passive and active transfer modes. With
this option disabled, the client is limited to using passive mode. If the FTP server requires
Chapter 6: Security Mechanisms
390