I'd like to summarize the key differences between active
and passive modes before continuing.
At a protocol level, active mode clients send the port command,
which contains an ephemeral port on which they listen,
and passive mode clients send the PASV command,
which requests a port allocation by the server.
In active mode, the server initiates a session to the client,
and in passive mode,
the client initiates a session to the server similar to
how the FTP control channel is formed.
Active mode simplifies the firewall design near the server since
all the data sessions are originated there.
And conversely, passive mode simplifies client-side firewall design.
This is a key tradeoff.
Remember, there are usually many more clients than servers,
making passive mode the generally preferred option.
Active mode FTP across network address translation,
or NAT, requires specific FTP aware software,
while passive mode FTP works across most NAT designs without any hassle.
Last, just know that active mode is not recommended without a good reason,
and I suggest you use passive mode as a general rule.
In the next module,
we'll tackle the big problem of confidentiality by using digital
certificates to encrypt our FTP transmissions. See you in the next module.