ftp protocol-download policy can not matched

[Jeff_Gao]

Dear 

I want to limit ftp client only download and can not upload,I try to configure policy as follow:

But the traffic from client to ftp server can not match the policy,it's matching the cleanup rule.

R55 is working well,I just configure the policy in R80.40 and same the R55,but no working,pls help!

[CPRQ]

We have some other ftp issue when move from R77 to R80.20. We used sk45085.

fw ctl get int fw_ftp_allow_double_parenthesis_termination
fw_ftp_allow_double_parenthesis_termination = 0

fw ctl set int fw_ftp_allow_double_parenthesis_termination 1

fw ctl get int fw_ftp_allow_double_parenthesis_termination
fw_ftp_allow_double_parenthesis_termination = 1

[Jeff_Gao]

but i no enable anti-virus,i just enable app&url .

[PhoneBoy]

In R55, this was done using the Security Servers.
I’m guessing you are doing this with App Control.
Are you sure the FTP connection is not TLS encrypted?
That may make detection of this…problematic.

[Jeff_Gao]

yes,there is no tls encrypted,you can demo it.

[PhoneBoy]

Recommend a TAC case.

[Jeff_Gao · Accepted solution]

I have solved it by two policy:

policy one:

                 source:ftp client      dest:ftp-server  services/applications:ftp porotocol-upload  action:drop

policy two:

                source:ftp client      dest:ftp-server  services/applications:ftp  action:allow