This INTEGER object (enable or disable) controls whether the FTP proxy is allowed to create a dynamic packet filter for FTP data transfer, a mechanism the desc describes as layer 2 forwarding. An administrator enables this so passive or active FTP data connections, which use unpredictable secondary ports, can be dynamically opened through the firewall as needed rather than requiring a large static port range. For example, enabling this setting for a policy handling passive-mode FTP transfers would let the proxy punch a temporary hole for each data connection as clients negotiate it.