> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/connection-methods/ftp-and-ftps/troubleshooting-ftp.md). # Troubleshooting FTP FTP connection issues commonly come from a firewall or an incorrect client setting. Work through the checks below before opening a support request. ## Check for Firewall Issues FTP is frequently restricted by corporate and network firewalls. Firewall changes can interrupt an existing connection because FTP uses separate command and data connections. ### IP Whitelisting If your firewall whitelists IP addresses, confirm that every IP used by your appliance is on the list. If your firewall administrator requires an explicit whitelist for FTP traffic, request that they allow FTP ports `21` and `990`, plus data ports `40000-49999`, to all IP addresses used by your appliance. ### Active or Passive Mode Use passive mode unless the network is specifically configured for active FTP. ExaVault supports both, but active mode requires the server to open a data connection back to the client and is often blocked by firewalls or network address translation. ## Connection Settings in Your FTP Client The settings below cover the most common client-side causes of FTP failure. ### Hostname Connect with FTP or FTPS to the fully qualified domain name of your appliance. Do not include `https://` at the start of the address. When your client requires an IP address, use the external IP address configured in the Appliance Manager. ### Port The default FTP port of `21` is blocked or interfered with by many corporate firewalls. Use port `21` for plain FTP or explicit FTPS; the client's explicit TLS setting determines whether the connection is encrypted. Use port `990` for implicit FTPS, which begins TLS as soon as the connection opens. If a client reports that it expected TLS, verify that its explicit or implicit security mode matches the selected port. Do not select SFTP while using an FTP or FTPS port. ### Timeout When your client supports it, set the connection timeout to 300 seconds. ### Retry Logic When your client supports it, configure five connection retries at 90-second intervals. This lets the client recover from a transient connection failure. ### Keepalives ExaVault times out FTP sessions that have been idle for 120 seconds, to prevent unused sessions from holding server resources. Most FTP clients handle these idle timeouts without issue, completing transfers in progress and reconnecting on the next command. Some clients abort the transfer or error out on the idle timeout. When that happens, enable the client's keepalive setting (null packets or dummy commands) at an interval of 100 seconds. ## How Active and Passive FTP Work FTP uses multiple network ports to move data between client and server. One port is the command channel; one or more ports are data channels. The command channel carries session controls and directory listings; the data channels carry file contents during upload and download. The command channel uses port `21` or `990`. The data channels use other ports and are established in different directions depending on the FTP mode. A firewall that allows the command channel but blocks the data channels can let a client sign in and list directories while preventing file transfers. ### Active Mode Active mode predates modern firewall and network-address-translation designs. Use it only on a network that is explicitly configured to accept the server's inbound data connection. In Active mode, the client opens the Command channel to the server. The port depends on the FTP variant: * FTPS (implicit FTP over TLS): port `990` * FTPeS (explicit FTP over TLS): port `21` * Plain, insecure FTP: port `21` The command channel is established from the client to the ExaVault FTP server. Once authenticated, the FTP server connects back to the client to open a data channel. The client supplies the address and port. Active data channels are established from the ExaVault server to the client. Transfer commands flow over the command channel; file contents flow over the data channels. ### Passive Mode Passive (PASV) mode was designed for clients that cannot accept inbound connections, including clients behind firewalls or on a NAT subnet. Because firewalls and NATs are now standard, Passive mode is the recommended FTP mode. In Passive mode, the client opens the Command channel to the server in the same way as Active mode. The port depends on the FTP variant: * FTPS (implicit FTP over TLS): port `990` * FTPeS (explicit FTP over TLS): port `21` * Plain, insecure FTP: port `21` The command channel is established from the client to the ExaVault FTP server. Once authenticated, the FTP server chooses a port from its passive range and tells the client which port to use. The client then opens the data connection to that port. Every ExaVault FTP variant uses the same passive data-port range: * Passive (PASV) mode: ports `40000-49999` Older ExaVault versions and documentation used ports `21000` to `21050`. Current appliances no longer use that legacy range. Passive data channels are established from the client to the ExaVault FTP server. Transfer commands flow over the command channel; file contents flow over the data channels. ### Recommendations Do not use Active mode unless there is no firewall between the FTP client and ExaVault. Always use Passive mode for FTP and FTPS connections to ExaVault. When the client can connect and traverse directories but cannot upload or download, the data channel may be blocked. Allow client connections to the ExaVault passive port range through the firewall. FTP uses the `STOR` or `RETR` command to begin a transfer before moving file contents over the data channel. Zero-byte files after a failed transfer often mean the command succeeded but the data channel was blocked. FTPS presents whichever SSL certificate is active on the appliance. A new appliance starts with a self-signed certificate, so FTPS clients may display a security warning until you enable automatic SSL certificate management or upload a valid certificate with its complete certificate chain. When a client reports an invalid, unexpected, or expired certificate, confirm that you are connecting to the correct hostname and that the expected certificate and intermediate certificates are installed on the appliance. See [Installing or Updating an SSL Certificate](/administration/installing-or-updating-an-ssl-certificate.md) for an explanation of certificate trust, automatic management, and manual certificate chains. ## ExaVault Configuration to Check When the checks above have not resolved the issue, confirm that the user is enabled and that the username and password are correct. In the appliance interface, enabled users show a green check and disabled users show a red X. Select a disabled user and toggle Enable/Disable to enable it. Use [Investigating Login Failures](/authentication-and-identity/investigating-login-failures.md) to find the attempt in Activity and check the user's authentication method, expiration, and lockout state.