Ask4key IT & Network Customer Support

Product : Zscaler Private Access

1. Introduction 

To troubleshoot the issue of user unable to FTP to external server through Zscaler Private Access.

2. Before You Begin 

 2.1. Preparation Checklist 

 2.2. Safety and Precautions 

• Backup the configurations such as the original policy configuration to prevent future confusion.
• If going to do pilot testing policies, always rollback if things go unsuccessful.

3. Step-by-Step Troubleshooting Guides 

1. Check the traffic going through ZPA or ZIA. Remember ZPA always have higher precedence than ZIA.
   1. This can be found by turning on/off ZPA or ZIA to find out. 
      1. If turning off ZPA suddenly can work, that means ZPA configuration has issue like port might not be configured.
      2. If turning off ZPA cannot work, which means traffic should go ZIA:
         1. If going ZIA cannot work, is because FTP control is not enabled, must enable them in ZIA admin portal.
         2. If going ZIA can work, that means the application is hosted publicly so may ask user whether they want to maintain using ZIA or not.
         3. If user FTP application is private, so turning off ZIA / ZPA or on both doesn't work, then we focus on ZPA first.
2. if it is ZPA:
   1. Check diagnostic logs
   2. Check app connector health.
   3. Check policies configuration especially on-health checking, whether it is wildcard, port number is properly configured in the custom-defined application segment.
3. If it is ZIA:
   1. Just to ensure FTP control all FTP related configuration are turned on, if they are not turned on, may inform user to turn them on.

• Putty
  • For testing FTP, putty can be used to test the connection, but be aware, if putty managed to establish connection but showing some error, it could indicate server refusing to connect due to several issue, it could be the health checking mechanism. 
  • Otherwise if putty direct decline the connection request, that means it is totally blocked.
  • if putty show time out that could indicate server does not respond or not alive or unreachable.
  • Attention, there is a passive/active mode to be enabled/disabled in putty, read the 5th below to understand better. So by tuning this configuration might also achieve some troubleshooting.
• Telnet
  • Can try command as below :
    1. Type ftp ask4keyftp.com in cmd.
    2. Then type username and password.
    3. If connection established successfully, then it could mean port is success.

5. Some important knowledge to know:

• File Transfer Protocol (FTP) can run in active or passive mode. 
  • Active mode FTP requires a TCP connection to be initiated from the server to the client.
  • While passive mode FTP requires client-initiated TCP connections only.
    
• If an FTP client attempts active mode FTP or sends an active mode request in parallel to the passive mode request, the attempt fails.
  
• ZPA does not support active FTP mode. It only supports passive FTP mode.
  
• A ZPA Enhancement Request (ER-5700) for active FTP support is under consideration.
• If an FTP client attempts active mode FTP or sends an active mode request in parallel to passive mode request, the attempt will fail.
  
  Also, ensure the following configurations: 
  • TCP Port Ranges to be added: Add all TCP ports (i.e, 1 to 65535)
  • Health Reporting: Select None. ZPA App Connector health reporting must be set to None because each FTP data channel is pseudo-random and opened on a per client basis.

Reference :

https://zscaler.my.site.com/customers/s/article/000002964