[dantro]

(1) Please connect to your firewall cluster and make sure that the member is active.
[Expert@optauk_cpcluster01]# cphaprob stat

(2) Enter the following command:
[Expert@optauk_cpcluster01]# fw monitor -e 'accept((src=63.245.208.138) or (dst=63.245.208.138));'

(3) Connect to LEONIS.

(4) Enter the following command:
LEONIS:~ # ftp ftp.mozilla.org 21
Login as anonymous user (if possible).

(5) Go back to your firewall. Enter Ctrl-C to Stop. Copy and paste us the output.

Btw, you shouldn't need to define ftp,ftp-bidir,ftp-pasv,ftp-port all together. Just ftp (TCP-Port: 21) will do fine.

As a test, please create a new TCP object 'port_21' with Port: 21. Uncheck 'Match for Any' but DON'T touch other settings. Temporary change ftp,ftp-bidir,ftp-pasv,ftp-port from Port 21 to Port 2121. Use the new object port_21 in your Rule #8. Install the policy and check if it works.

Best regards,
Danny Trommer
CCSA/CCSE/CCSE+