Zscaler - SSL/TLS Inspection
In this article
Configuring the FTP Control Policy in ZIA
The FTP Control policy in Zscaler Internet Access (ZIA) lets administrators permit or block native FTP and FTP-over-HTTP traffic to specific URL categories or sites. Like most ZIA firewall features, it is deny-by-default: without explicit configuration, users cannot upload or download files to or from FTP sites.
What FTP Control Does
FTP Control governs two traffic types — native FTP and FTP-over-HTTP — which can be enabled independently. Once enabled, administrators choose whether to allow FTP access to any URL category or, following best practice, restrict it to specific destinations. These settings are global, applying to all FTP traffic organization-wide, and work together with the Firewall Control policy, which determines who may reach those destinations.
Default Behavior
Before any rule is configured, FTP connections fail by default. Attempting to log in to an internet-reachable FTP server from a standard user workstation is rejected outright, confirming FTP access has not yet been enabled or granted to that user or group.
Configuring a Rule
FTP Control is found in the ZIA console (sign in at console.zscaler.com through the Zscaler Authentication Service) under Internet Access > Policy > FTP Control, alongside other Internet Access policy items such as Firewall Control and DNS Control.
1. Enable native FTP (and FTP-over-HTTP, if needed).
2. Choose whether to allow all URL categories or restrict to specific destinations. As a best practice, enter the specific FTP server address rather than opening the policy broadly, then save the change.
3. Create a Firewall Control rule granting the appropriate group access — for example, scoped to an IT Engineering group, with Services set to FTP under Network Services, other fields at their defaults, and the action set to Allow. Save and activate the configuration.
A common mistake is assuming the specific FTP server address from step 2 is sufficient on its own. URL Filtering takes precedence over FTP Control, so if Allowed URL Categories is left at None, connections still fail with a "not allowed by company policy" message, even with the destination added and a Firewall Control allow rule in place.
To resolve this, use the URL Lookup tool (in the support tools at the lower left of the console) to see how the FTP server's URL is categorized — for instance, Internet Services and Professional Services — and add those categories to Allowed URL Categories. Save and activate the change.
Alternatively, allow all URL categories under FTP Control and instead restrict access by adding the FTP server's FQDN as the only allowed destination in the Firewall Control rule. Both approaches work, showing that ZIA policies often support more than one valid path to the same requirement.
Testing the Policy
After activation, test from the target user's workstation by connecting to the FTP server and, once connected, transferring a file to confirm the policy is fully functional, not just permitting a login.
To validate the traffic, check the logs. FTP has no dedicated insight view the way DNS Control does — sessions log under Firewall Insights because enforcement runs through Firewall Control. Filter using Client Destination IP (resolved from the FTP server's hostname). Results should show earlier attempts blocked by the default deny-all rule, followed by allowed sessions matching the FTP rule.
FTP Control sits alongside IPS Control (signature-based intrusion prevention, enabled by default) and Forwarding Control (redirecting selected traffic, such as to a third-party proxy) among ZIA's cloud-based firewall capabilities.