Using Explicit FTP over TLS

Do you have a rule in place to allow the secure connection out with logging enabled?

Short answer... no.

Happy to create a new rule for this purpose. but to be honest, I do not know what ports/services should be used.
Any advice on this would be appreciated.

I should probably add...

Ports 21 and 443 are open to outbound traffic.
When trying to connect to the FTP server I see successful attempts on port 21, but nothing else.

As mentioned, it looks like the connection to the FTP server authenticates successfully, but it always fails to do a directory listing when using the Explicit TLS connection option.

Do you have the ftp helper enabled?

Do you mean the FTP proxy?

If so, then no, it is not enabled as I thought that this is only if I have a FTP server behind the UTM.
Please correct me if I am wrong about that.

No, it is here to help with the extra port that ftp uses. I ti s not actually a proxy, but a session helper to ensure that the ftp control port is associated with an active ftp session.

I have looked, but have not been able to find a FTP Helper option.
Where is that option located?

firewall -> advanced.

there are a number of similar features on that page.

Yes, the FTP connection tracking helper was enabled. I am guessing that this is the default state, as I cannot remember ever setting that option.

So... that is not the issue. Any other suggestions?

What is your outbound rule? You should see all connections in the firewall log.

I suspect that the issue is really that you have the web proxy enabled in transparent mode so all traffic will be picked up by the web proxy.

Try adding an exclusion for the site your are going to in the web proxy exclusion list.