The Symantec Brightmail Gateway and Symantec Messaging Gateway uses Passive (PASV) FTP. Most firewall have the option for PASV.
Understanding PASV (Passive) FTP
The Symantec Brightmail Gateway and Symantec Messaging Gateway uses PASV FTP to perform the db-backup command and the Control Center’s backup section. Commonly, Firewall Administrators request strict port control and allow only few well-known protocol ports open. PASV FTP uses ephemeral port number (random temporary port number) along with port 21 to synchronize the FTP command responses.
As an alternative, the Command Line Interface command db-backup provides SCP (secure copy) protocol. SCP uses a strict port assignment. The default port is port number 22 and provides secure upload to the data server.
NOTE: The db-backup command does not provide scheduled backup option