Question

FTP requires two ports to be defined in the access control list, why is this?
Should basic ACL and advanced ACL be deployed near the source network or target network, and why?

Answer 1

FTP and ACL

FTP stands for File Transfer Protocol. To successfully establish an FTP session between networks, the active FTP mode of operation uses two ports; data port of 20 and control port of 21. FTP sessions failures are due to permitting control port 21 through ACL and denying the data port 20, or denying the control port 21 and permitting data port 20 through ACL.

The syntax to permit the control port 21;

        
        access-list 101 permit tcp any any eq 21

When we uses both the ports, it permits TCP traffic from any source, such as the FTP client to any FTP server destination at FTP control port 21.

The syntax to permit the data port 20;

access-list 101 permit tcp any eq 20 any

It permits TCP traffic from any source, such as the FTP server to any FTP client destination at FTP data port 21.

An Access Control List(ACL), can be called as a function which filters the incoming and outgoing traffic, also compares it with a set of rules.

At the source or destination networks, advanced ACL should be deployed because the basic ACL doesn’t provide strong security. Using extended ACL we can filter the traffic based on protcol information like TIC, IP, UDP, ICMP. So that the security of incoming and outgoing packets can be determined and ensure the network security.