Comment # 1 on bug 950255 from Lukas Ocilka

I've just tested this with Yast Firewall from SLES 12 SP1 which should contain
the very same version.

1. Copy /etc/sysconfig/SuSEfirewall2 to SuSEfirewall2-backup
2. Run Yast Firewall
3. Allowed Services
4. Switch to External Zone if needed
5. Advanced
6. Add "ftp" to TCP and UDP
7. OK, Next

Now the summary doesn't contain any info about allowed services because
my interfaces are not in any zone. This needs to be done manually in UI.

8. After saving the configuration, ftp is written to sysconfig:

diff -u SuSEfirewall2-backup  SuSEfirewall2
--- SuSEfirewall2-backup        2015-10-15 11:06:07.605178809 +0200
+++ SuSEfirewall2       2015-10-15 11:06:45.485180079 +0200
@@ -250,7 +250,7 @@                                                             
 #                                                                              
 # Note: this setting has precedence over FW_SERVICES_ACCEPT_*                  
 #                                                                              
-FW_SERVICES_EXT_TCP=""                                                         
+FW_SERVICES_EXT_TCP="ftp"                                                      

 ## Type:       string
 #
@@ -264,7 +264,7 @@
 #
 # Note: this setting has precedence over FW_SERVICES_ACCEPT_*
 #
-FW_SERVICES_EXT_UDP=""
+FW_SERVICES_EXT_UDP="ftp"

Please attach Yast logs, so we can see more there.
https://en.opensuse.org/openSUSE:Report_a_YaST_bug

Your proposed solution already exists, but the service definition belongs
to a particular ftp server. There was a vsftpd installed on my system, so
I was also able to add a 'vsftpd' service (instead of FTP). Name of the
service is also maintained by the package.

See more at
http://kobliha-suse.blogspot.cz/2008/06/firewall-services-defined-by-packages.html