FTP profiles for LTM¶

F5 BIG-IP Local Traffic Manager (LTM) on cloud-native network functions (CNFs) supports File Transfer Protocol (FTP) traffic processing through FTP profiles. An FTP profile lets a virtual server understand and manage FTP control and data connections so it can correctly load balance FTP traffic across pool members.

When you attach an FTP profile to a virtual server, the system inspects FTP control channel commands. It then opens and manages the related data connections on your behalf. This is important because FTP uses separate connections for commands and data, and a load balancer must coordinate both to deliver traffic correctly.

How FTP profiles work¶

FTP uses two connections:

Control connection — carries commands and responses between the client and server (typically on port 21).
Data connection — carries the actual file content (typically on port 20, but configurable).

Without an FTP profile, the load balancer treats FTP traffic as a plain TCP stream. It can’t track the relationship between the control and data connections. With an FTP profile, the system:

Monitors the control channel for commands that set up data transfers.
Dynamically creates data channel connections and directs them to the correct pool member.
Optionally supports FTPS (FTP over TLS) for encrypted transfers. When SSL profiles are attached to the virtual server and allowFtpsMode is set to allow or require, the system decrypts and inspects FTPS traffic. Without SSL profiles, allow mode passes encrypted traffic through without inspection.
TLS configuration requires existing SSL profiles within the F5 Virtual Server.
```
clientssl: clientssl-profile
serverssl: serverssl-profile
```

Key capabilities¶

Active and passive FTP modes — you can enable or restrict active mode transfers based on your security needs.
FTPS support — configure allowFtpsMode to control how the system handles FTPS negotiation. The behavior depends on whether SSL profiles (clientssl and serverssl) are attached to the virtual server:

`allowFtpsMode`	SSL profiles present	SSL profiles absent
`allow`	Decrypts, inspects, and applies FTP application layer gateway (ALG) processing.	Passes through encrypted FTPS traffic without inspection.
`require`	Requires STARTTLS; decrypts, inspects, and applies FTP ALG processing.	Misconfigured state. TMM logs a warning and cannot inspect FTPS traffic.
`disallow`	Rejects any client connection that sends AUTH TLS or AUTH SSL.	Rejects any client connection that sends AUTH TLS or AUTH SSL.

TLS session reuse enforcement — optionally reject data connections that don’t reuse the control channel’s TLS session.
TCP profile inheritance — the data channel can inherit the TCP profile from the control channel for consistent behavior.
IPv4 and IPv6 compatibility — the translateExtended setting ensures FTP commands work correctly across IP versions.
Configurable data port — change the default data port (20) when your environment uses a non-standard port.
Logging — attach a logging profile to the virtual server to capture FTP-related events through high-speed logging (HSL).

Custom Resource Definitions¶

FTP profiles in LTM on CNF are configured using Custom Resource Definitions (CRDs):

F5BigFtpSetting — defines the FTP profile settings.
F5VirtualServer — references the FTP profile by name using a soft reference in the ftp field.

The FTP profile is created as a separate custom resource (CR) and then linked to the virtual server CR. This separation lets you reuse the same FTP profile across multiple virtual servers.

Configure an FTP profile for a virtual server¶

Follow these steps to create an FTP profile and attach it to a virtual server on F5 BIG-IP LTM on cloud-native network functions (CNFs). After you complete this task, the virtual server can process File Transfer Protocol (FTP) control and data connections for load balancing.

Before you begin¶

Before you start, make sure you have:

A working LTM on CNF deployment.
A TCP profile configured for the FTP control channel.
(FTPS only) Client-side and server-side SSL profiles configured on the virtual server. Without these profiles, the system cannot decrypt and inspect FTPS traffic. If allowFtpsMode is set to require without SSL profiles, TMM logs a warning and FTPS inspection doesn’t work.

Create the FTP profile¶

Create a YAML file named ftp-profile.yaml with the following content. Adjust the settings to match your environment:

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFtpSetting
metadata:
  name: "ftp-profile"
spec:
  translateExtended: true
  inheritParentProfile: false
  dataPort: 20
  allowActiveMode: true
  allowFtpsMode: "allow"
  inheritVlanList: true
  enforceTlsSessionReuse: false

Apply the FTP profile to your cluster:
```
oc apply -f ftp-profile.yaml
```

Verify that the FTP profile was created:

oc get f5-ftpsettings ftp-profile -o yaml

Attach the FTP profile to a virtual server¶

Create a YAML file named ftp-vs.yaml with the following content. Replace the destination address, port, profile names, and SSL profile names with your values. The clientssl and serverssl fields are required when allowFtpsMode is set to allow or require.

apiVersion: k8s.f5net.com/v1
kind: F5VirtualServer
metadata:
  name: ftp-vs
spec:
  destinationAddress: 10.0.0.100
  destinationPort: 21
  protocol: tcp
  protocolProfile:
    clientside: ftp-tcp
    serverside: ftp-tcp
  # Required for FTPS: attach client-side and server-side SSL profiles
  clientssl: clientssl-profile
  serverssl: serverssl-profile
  ftp:
    ftp-profile
  snat:
    type: automap

Apply the virtual server configuration:
```
oc apply -f ftp-vs.yaml
```
Verify that the virtual server is running and references the FTP profile:
```
tmctl -dblade -w140 profile_ftp_stat
```

(Optional) Configure a wildcard virtual server for FTPS passive mode¶

If you set allowFtpsMode to allow without SSL profiles, the system passes encrypted FTPS traffic through without inspection and only supports passive-mode data connections. You must create a wildcard virtual server to handle these data connections.

Create a YAML file named ftp-wildcard-vs.yaml:

apiVersion: k8s.f5net.com/v1
kind: F5VirtualServer
metadata:
  name: ftp-wildcard-vs
spec:
  destinationAddress: 0.0.0.0/0
  destinationPort: 0
  protocol: tcp
  snat:
    type: automap

Apply the wildcard virtual server:
```
oc apply -f ftp-wildcard-vs.yaml
```

Note

If the FTP virtual server uses SSL profiles for FTPS, the wildcard virtual server must use the same clientssl and serverssl configuration.

Verify FTP traffic processing¶

Connect to the FTP service through the virtual server’s destination address.
Perform a file transfer to confirm that both control and data connections are handled correctly.
```
tmctl -dblade -w140 profile_ftp_stat
```
You can verify login_requests, download_requests, upload_requests and so on.