When testing or running an FTP host in MOVEit Automation using passive mode, the connection succeeds on login but fails when listing the directory. The host test and tasks fail with the following error:

Could not list directory: The Server failed to connect on the data port.
Response: 425 Failed to establish connection.

The FTP control connection (port 21) succeeds, and the PASV command completes successfully, but the directory listing fails.

The firewall was blocking the FTP passive data ports required for the data channel connection.

Although port 21 was open and the FTP server successfully entered passive mode, the firewall was not allowing traffic on the dynamically assigned passive data ports. As a result, MOVEit Automation was unable to establish the data connection required for directory listing (LIST) and file transfers.

Update the firewall configuration to allow FTP passive data ports.

1. Identify the passive port range configured on the FTP server.
2. Ensure the firewall allows outbound connections from the MOVEit Automation server to the FTP server on:
   • TCP port 21 (FTP control channel)
   • The full configured FTP passive port range (TCP)
3. After the firewall rules are updated, re-test the FTP host connection in MOVEit Automation.

Once the required passive ports were allowed through the firewall, the FTP host test and directory listing completed successfully.

FTP passive mode requires two connections:

• Control connection (TCP 21)
• Data connection (server-selected high TCP port)

GUI FTP clients may appear to work due to retries or adaptive behavior, while MOVEit Automation performs strict protocol validation and fails immediately if the data connection cannot be established.Allowing only port 21 is not sufficient for FTP passive mode.