AFM and FTP

I need to autorize FTP (via AFM) on the global context, but how to handle the dynamic port negociation between client and server ?

as long as ftp control channel is allowed, global or route domain context won't drop/reject ftp data channel.

there is a bug about global or route domain context action in 11.5.0 which is fixed in 11.5.1 hf4 and 11.6.0.

ID456107 [Network Firewall] If AFM rule action (at global or rtdom contexts) is Drop/reject, LTM overrides this action for EPHEMERAL connections (such as FTP data channel) without any visibility