Zonealarm (my memory of prev versions) works at a VERY low granularity.
For each app, allow client (outgoing) and allow server (incoming) - if your FTP client is not in PASV mode, it may need allow server.
Outpost (free/pro) and Kerio are both "rules based", so that port ranges are included in the rule set.
Sygate (free) is partially rules based - a limited number of them, but unlimited application permissions - so you can save the advanced rules for when you need them.