Windows Server 2022 - IIS - FTP Sites / FTP Publishing

Good Day

I have two Windows Server 2022 Data Centre VM's in Azure. I'm attempting to set them up as IIS servers, so I can host a bunch of ASP.Net sites. They'll be setup to load balance, so if one goes off-line we'll be fine. I've set them up with ASP.Net, IIS and importantly FTP Server. I've configured the sites, but can't get a stable “always-on” FTP connection.

No matter what I change, toggle, or set, I can't get FileZilla to consistently connect to them. Randomly, I'll be able to establish a connection, but I can't figure out any pattern or setting that is making this work.

I have the Azure VM Network Firewall setup to only allow my address to connect over 21 FTP and 990 FTPS, and I can get to this point with FileZilla: “Status: Retrieving directory listing…”, with the following output:

“
Command: PWD
Response: 257 “/“ is current directory.
Command: TYPE I
Response: 200 Type set to I.
Command: PASV
Response: 227 Entering Passive Mode (blah).
Command: LIST
Response: 150 Opening BINARY mode data connection.
“

I've tried setting a passive port range in “FTP Firewall Support”, and allowing that range through the Azure Firewall, to no effect. Occasionally if I enter “FTP Firewall Support”, remove the ports, set them back to 0-0, and set my IP and “Apply”, then reboot a VM, the FTP will connect.

I've managed to push 1 ASP.Net site to 1 VM, and it's working fine, so my only question is how the bleep do you get FTP working with Windows Server 2022, IIS, and Azure?

I've tried enabling publishing and setting up a dedicated FTP site. My steps to configure FTP Publishing:

1. Right click site "Add FTP Publishing”
2. IP: All Unassigned Port: 21
3. (Default checked) Start FTP Automatically
4. Require SSL with the cert
5. Authentication Basic -> All Users -> Read / Write
6. Finish

The same steps are preformed for adding an FTP site, so is this wrong? Should I run a third party FTP Server, that seems silly as I'd assume Microsoft and IIS would be the obvious choice.

Thanks for any help!

It appears you have to set a “Data Port Range” by clicking the name of the VM in IIS Manager, selecting “FTP Firewall Support”, then entering the port range ex: 9000-9100, saving, and restarting “Microsoft FTP” in services.

The steps to make this work:

1. Right click site “Add FTP Publishing”
2. IP: “All Unassigned” Port: 21
3. Require SSL → Select Cert
4. Authentication Basic → All Users → Read / Write
5. Finish
6. (Click Site Name) FTP → “FTP Firewall Support”
7. Enter the public IP in “External IP of Firewall”
8. (Click VM Name) FTP → “FTP Firewall Support”
9. Enter a port range ex: “9000-9100” in “Data Channel Port Range”
10. Apply
11. Go to Services
12. Restart: “Microsoft FTP Service”

Then in Azure:

1. Go to Networking
2. Add inbound rules for ports 21 and the range above, ex: 9000-9100

Now you should be able to connect through an FTP Client like FileZilla. I'm sure there's a reason it's this complex to get FTP Publishing up and running with IIS. Hopefully this helps someone.