At least on my ZS box (currently a beta12 install) the appropriate iptables connection tracking modules for FTP are installed. However there needs to be some rules in the iptables to allow the connections “related” to the FTP command connections for this to work.
I’ve not setup FTP through my ZS box so I can’t give you the exact setup, but if you do a web search for “iptables ftp” you’ll find some links telling you what the end result has to be. Then the next step is figuring out the changes in the ZS GUI that will end up with the same result.
I guess this is not a really useful reply, but it might get you started.