Remember that FTP data mode -- what's used when a server delivers a file to
a client -- runs in reverse. This makes FTP connections more difficult. The
sequence:
1. Client connects from client-ip:random-port-1 to server on
server-ip:21/tcp
2. Client authenticates if necessary
3. Client requests a file
a. Client establishes a listener on itself -- on client-ip:random-port-2
b. Client informs servers of this listening port
4. Server sends file to client
a. Server connects from server-ip:20/tcp to client-ip:random-port-2
b. Server downloads content
c. Server and client close connection
Your IPsec policies must account for the data mode connection that comes
from the server on the server's port 20/tcp to the client on the client's
random-port-2.
Steve Riley
(e-mail address removed)