Sorry, I do not know what "decryption policy" is this about. Is your firewall trying to decrypt the FTP connection?

Hello!
After some investigations, we found that WinSCP fails to list directories while the decryption policy is enabled on our Palo Alto firewall.
When the decryption policy is disabled, connection and directory listing works fine.
There are no errors in the decryption policy log. Also, other FTP clients work with decryption policy enabled.

What data can I provide to help analyze this case?
Or WinSCP won't work with the decryption policy enabled on the firewall?

Thank you!

Please post new logs for connection to FileZilla Server 1.8, as well as server log files.
Also, does it work, when you connect directly on the server (not via NAT)?

Hi Martin!
I have upgraded the FileZilla Server to version 1.8, but I still getting the same error.
The "Reuse TLS session ID for data connections" session option is enabled in WinSCP client.

For me WinSCP works without any problem against FileZilla Server 1.8.
Please try to upgrade your FileZilla Server installation.

And make sure you didn't turn off "Reuse TLS session ID for data connections" session option.
https://winscp.net/eng/docs/ui_login_tls

Hello!
What do I have:

• FileZilla FTP server v. 1.7.3 behind the NAT with passive mode enabled and custom port range (50100–50200) that is also allowed in the firewall settings.
  
• WinSCP client v. 6.2.2 beta (Build 14641). Also tried v. 6.1.2
  

I am trying connecting to the FTP server from the external network using FTPS (explicit encryption) and getting the error

Error listing directory '/'.

The session is established, but I can't see any file in my user's directory.

Connection within the internal network works fine.
I have also tried FileZilla, RealFTP, and SmartFTP clients – they successfully connect and can list directories.
Logs from the FileZilla server, WinSCP client, and FileZilla client are attached (as a private file).

Please advise.
Thank you!