You might be wondering why there isn't a demonstration to
update and retest our firewall policy for FTPS.
If you recall from the previous packet captures,
FTPS works just like FTP in terms of signaling and data transfer.
All of the same TCP ports are used.
I'm showing a passive mode operation in this diagram since
the client initiates both TCP sessions.
This recycling of firewall policy is a big advantage to FTPS over SFTP,
covered in the next module,
especially in environments with many network-based security appliances.
The one caveat is that FTPS in active mode cannot work across a NAT device now,
even with FTP-aware software because the PORT command is encrypted.
FTPS passive mode will work across a NAT device just fine,
so I'd recommend using passive mode for both unsecure FTP and FTPS whenever possible.