If you get this error when doing FTP transfers in passive mode, the problem could be that there are multiple IP addresses on the external interface. (You may alternatively see the error "425 Can’t open data connection.".
A Microsoft knowledge base article explains it: http://support.microsoft.com/kb/817829
"When the client establishes a passive mode FTP connection to an FTP server, the client must establish both connections. The FTP server returns the TCP port used for the FTP data connection. The FTP server expects this FTP data connection to come from the same IP address as the FTP control channel. If the connection comes from a different IP address, the FTP server may reject or close the connection because this may be a passive mode port theft attempt.
When ISA has more than one IP address bound to the external interface, the source IP address for the FTP data connection may not be the primary IP address. Instead, the source IP address may be one of the secondary IP addresses bound to the external interface. With the hotfix installed, ISA always uses the primary IP address for both types of connections."
The solution: "You must install ISA Server Service Pack 1 (SP1) before you install the following hotfix."
