--- title: πŸ” Zscaler Support for Active vs. Passive FTP description: Understanding FTP Behavior Through the Zscaler Cloud Proxy and Best Practices for Connectivity --- [Skip to content](https://securedynamics.net/kb/zscaler-support-for-active-vs.-passive-ftp#main-content) English Show submenu for translations ![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png) Open main navigation Close main navigation - English Show submenu for translations - Go to securedynamics.net Go to securedynamics.net Hello. How can we help you? - There are no suggestions because the search field is empty. 1. [SecureDynamics Knowledge Base](https://securedynamics.net/kb?hsLang=en) 2. [Support](https://securedynamics.net/kb/support?hsLang=en) # πŸ” Zscaler Support for Active vs. Passive FTP ## Understanding FTP Behavior Through the Zscaler Cloud Proxy and Best Practices for Connectivity ### πŸ“Œ Summary This article explains how Active and Passive FTP modes behave in Zscaler environments, provides configuration tips, and offers best practices to ensure FTP connectivity through Zscaler Internet Access (ZIA). --- ### βš™οΈ What is Active vs. Passive FTP? **🧭 Active FTP** - The client initiates the control connection to the server on **port 21**. - The server initiates a return data connection from **port 20** to the client. - Requires the client to accept inbound connections, which are typically blocked by proxies/firewalls. **🚦 Passive FTP** - The client initiates **both** the control and data connections. - The server responds with a dynamic port for data transfer, and the client connects to it. - Ideal for clients behind firewalls or proxies like Zscaler. --- ### πŸ›‘ Why Active FTP May Fail with Zscaler When users are behind Zscaler (especially when using Client Connector or a PAC file), **Active FTP can fail** due to the following: - Zscaler operates as a **cloud proxy**, meaning all outbound connections are initiated by the client. - Return connections (as used in Active FTP) are **not permitted** inbound through the Zscaler tunnel. - This design maintains **security and traffic control** within ZIA. --- ### βœ… Recommended Fix: Use Passive FTP Mode Zscaler fully supports **Passive FTP**, and this should be the default setting in all FTP clients. **βœ” Why Passive FTP Works:** - The client initiates all trafficβ€”both control and data channels. - No inbound connection is needed, allowing Zscaler to maintain the session securely. - Works across most network types and client environments. --- ### πŸ›  FTP Client Configuration To enable Passive FTP: 1. Open your FTP client (e.g., FileZilla, WinSCP). 2. Navigate to **Settings \> Connection \> FTP**. 3. Select β€œ**Passive Mode**” or β€œUse Passive (PASV) mode.” --- ### 🌐 Additional Configuration Recommendations **πŸ”§ Configuring the FTP Control Policy in ZIA** To configure the FTP Control policy: 1. Go to **Policy \> FTP Control** in the ZIA Admin Portal. 2. Configure the following settings: - **Allow FTP over HTTP**: By default, the Zscaler service doesn't allow FTP over HTTP. Enable this option if required. - **Allow Native FTP**: Enable this option to allow native FTP traffic. For detailed steps, refer to [Configuring the FTP Control Policy](https://help.zscaler.com/zia/configuring-ftp-control-policy). **βš™οΈ Recommended FTP Control Policy Settings** Zscaler recommends configuring the FTP Control policy as follows: - **Disable the Allow FTP over HTTP option**: This prevents FTP over HTTP traffic. - **Disable the Allow Native FTP option**: This prevents native FTP traffic. For more information, see [Recommended FTP Control Policy](https://help.zscaler.com/zia/recommended-ftp-control-policy). **πŸ›‘οΈ Supporting FTP Applications in Zscaler Private Access (ZPA)** For organizations using Zscaler Private Access (ZPA), it's important to configure the service to support passive FTP mode traffic. Detailed guidance is available at [Supporting FTP Applications](https://help.zscaler.com/zpa/supporting-ftp-applications). **πŸ”’ FTPS (FTP over TLS) Considerations** Zscaler does not support FTP over TLS in transparent mode. To enable FTPS, configure an explicit proxy in your FTP client settings. For example, in WinSCP, set up the explicit proxy to facilitate FTPS connections. More details can be found in the [Zscaler Community discussion on FTPS setup](https://community.zscaler.com/s/question/0D54u00009evmx9CAA/ftps-ftp-with-tls-setup). --- ### πŸ”’ Security Recommendations - **Use Secure Protocols**: Prefer **SFTP** or **FTPS** for encrypted file transfers and login credentials. - **Define Explicit Policies**: Configure **firewall rules and URL filters** to permit trusted FTP hosts and ports. - **Monitor Traffic**: Regularly review session logs in the ZIA Admin Portal for insights into dropped or blocked traffic. --- ### πŸ“¬ Need Assistance? If you're still experiencing FTP issues, please contact the SecureDynamics support team at or reach out to your Zscaler VAR for a **Free ZIA Health Check**. --- - [FAQs](https://securedynamics.net/kb/faqs?hsLang=en) - [Troubleshooting](https://securedynamics.net/kb/troubleshooting?hsLang=en#main-content) - [Client Connector Portal](https://securedynamics.net/kb/troubleshooting?hsLang=en#client-connector-portal) - [Zscaler Client Connector](https://securedynamics.net/kb/troubleshooting?hsLang=en#zscaler-client-connector) - [Support](https://securedynamics.net/kb/support?hsLang=en) - [SecureDynamics Internal](https://securedynamics.net/kb/securedynamics-internal?hsLang=en) - [Licensing](https://securedynamics.net/kb/licensing?hsLang=en#main-content) - [ZIA Upgrades](https://securedynamics.net/kb/licensing?hsLang=en#zia-upgrades) - [Education & Training](https://securedynamics.net/kb/education-training?hsLang=en) - [Delivery Services](https://securedynamics.net/kb/delivery-services?hsLang=en) - [Partner Help](https://securedynamics.net/kb/partner-help?hsLang=en) [![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png "SecureDynamics Zscaler Logo")](https://cm360.securedynamics.net?hsLang=en) securedynamics.net Help Center Copyright Β© 2026, SecureDynamics ```json { "@context" : "https://schema.org", "@id" : "https://securedynamics.net/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Santa Clara", "addressRegion" : "CA", "postalCode" : "95054", "streetAddress" : "5201 Great America Pkwy, Suite 320" }, "logo" : { "@type" : "ImageObject", "url" : "https://securedynamics.net/hubfs/SecureDynamics%20Zscaler%20Logo-1.webp" }, "name" : "SecureDynamics", "sameAs" : [ "https://www.linkedin.com/company/3626024/" ], "url" : "https://securedynamics.net/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://securedynamics.net/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "SecureDynamics", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : { "@type" : "EntryPoint", "urlTemplate" : "https://securedynamics.net/hs-search-results?q={search_term_string}" } }, "publisher" : { "@id" : "https://securedynamics.net/#organization" }, "url" : "https://securedynamics.net/" } ```