Support for FTP connections

About FTP connections

With FTP, the following two TCP connections are established between the client and the FTP server:

A control connection over which FTP commands from the client and responses from the FTP server are transferred
For example, the client requests an object and the server acknowledges the request. Some FTP commands elicit multiple responses from the server.
A data connection over which the server sends data to the client or the client sends data to the server
Files are transferred only over the data connection.

When a NetCache appliance is deployed, the NetCache appliance transfers commands on behalf of the client and receives the responses from the FTP server on behalf of the client.

Determining which device should establish the data connection

Before NetCache can retrieve a file from an FTP server (on behalf of the client), a data connection must be established with the FTP server. When you configure FTP support on NetCache, you specify how you want the data connection to be established.

Many administrators do not want the FTP server to establish the data connection to the NetCache appliance. The reason is that permitting a server outside their network to access devices on their network can pose a significant security risk. However, if server-side problems prevent the NetCache appliance from establishing a data connection to the FTP server, you need to consider allowing the FTP server to establish the connection to the appliance.

For example, if the FTP server responds positively to the NetCache request to establish the connection, but the FTP server does not accept connections to the IP address and port number that the NetCache appliance supplies, you might want to specify that the FTP server is to establish the connection. This situation might occur if an FTP server is behind a firewall that does not allow the connection requests to be passed through.

The optimal solution in this situation is for the administrator of the FTP server to reconfigure the system so that it allows the NetCache appliance to establish the connection to it. However, if you are unable to influence the FTP server's administrator to reconfigure the server, you can enable an option in the NetCache configuration so that NetCache can retrieve the desired object.

Note
If the firewall is set up to prevent FTP servers from establishing the connection to the NetCache appliance, specifying the option to allow the FTP server to establish the data connection prevents NetCache from proxying any FTP requests.

NetCache option for connection establishment

NetCache includes an option, FTP Connect by PORT, that enables you to specify whether NetCache is to establish data connections to FTP servers or whether NetCache will allow FTP servers to establish data connections to it. This option includes two suboptions, which are described in the following table.

Suboptions	Description
PASV, then Retry with PORT	This NetCache appliance will establish the connection to FTP servers. If the NetCache appliance is not successful, it sends a command to the FTP server to establish the connection to it. This is the default setting.
PORT Only	FTP servers will establish the connection to this NetCache appliance.

Location of the option

Select Setup tab > FTP > General in the Appliance Manager to access the FTP Connect by PORT option.

If the client uses the PORT command to establish a connection

The client can negotiate the data connection establishment with the NetCache appliance by using the FTP PORT and PASV commands. Even if the client establishes the connection to the NetCache appliance by using the PORT command, NetCache can still use the PASV command to establish the connection between the appliance and the FTP server. Your configuration of the FTP Connect by PORT option controls only how the connection will be established between the NetCache appliance and the FTP server.