When FTP ALG is configured in NSX Edge firewall, FTP data connection cannot be established by dropping packets by Edge firewall as this.
<4>Dec 5 23:35:13 NSX-edge-28-0 firewall[]: [default]: ACCEPT_133173IN= OUT=vNic_0 SRC=10.50.60.70 DST=10.20.30.40 LEN=52 TOS=0x02 PREC=0x00 TTL=127 ID=11893 DF PROTO=TCP SPT=51816 DPT=21 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0
<4>Dec 5 23:35:13 NSX-edge-28-0 firewall[]: [default]: DROP_131073IN= OUT=vNic_1 SRC=10.20.30.40 DST=10.50.60.70 LEN=52 TOS=0x02 PREC=0x00 TTL=124 ID=26151 DF PROTO=TCP SPT=20 DPT=51817 WINDOW=32768 RES=0x00 CWR ECE SYN URGP=0
<4>Dec 5 23:35:16 NSX-edge-28-0 firewall[]: [default]: DROP_131073IN= OUT=vNic_1 SRC=10.20.30.40 DST=10.50.60.70 LEN=52 TOS=0x02 PREC=0x00 TTL=123 ID=26153 DF PROTO=TCP SPT=20 DPT=51817 WINDOW=32768 RES=0x00 CWR ECE SYN URGP=0
<4>Dec 5 23:35:22 NSX-edge-28-0 firewall[]: [default]: DROP_131073IN= OUT=vNic_1 SRC=10.20.30.40 DST=10.50.60.70 LEN=48 TOS=0x00 PREC=0x00 TTL=123 ID=26154 DF PROTO=TCP SPT=20 DPT=51817 WINDOW=32768 RES=0x00 SYN URGP=0
This issue is resolved in VMware NSX Data Center for vSphere 6.4.13.
Workaround:
To workaround the issue, enable "net.netfilter.nf_conntrack_helper" on the NSX Edge: