Adding a Custom Application/Ports to Security Policy

[mario11584]

Maybe my thought process is wrong so I am hoping somebody can set me straight. I have a few non-standard ports that need to be opened on the firewall. They don't belong to any application so I need to allow the ports. What I have done is created custom applications with basically just a name and the ports used (no signatures). I created an application override for these custom applications as well. I then added these custom applications to the security policy along with other known applications that need access.

Is this the best way to open a port on the Palo Altos?

[apasupulati · Accepted solution]

Hi,

What you're doing will work, but you don't have to do an application override for this traffic. You can just configure a security policy, with application set to 'any' or 'custom-app' and define the service ports to allow this traffic through. By doing so you can also add security profiles to the traffic to enable inspection.

app-override will not perform any scanning on the traffic and this can cause threat especially if the traffic is to/from Internet.

Refer:

Does application override adversely affect Threat ID?

Hope that helps,

Aditi

[mario11584]

That's exactly the information I was looking for. Thanks so much for the help.

[mario11584]

Another quick question, I am wondering if I can have applications and service ports being used on the same policy? For example, if I use the web-browsing application and create and use a service using ports 60000-65000, will it allow http traffic as well as traffic on ports 60000-65000? Or should I create a policy that allows web-browsing then a separate rule for the service?

[kadak]

Hello Mario,

If you include web-browsing in the application column and 60000-65000 in the service column, that security policy would only allow web-browsing traffic on ports 60000-65000. You would need a separate rule to allow web-browsing on its default port (80).

Best would be to include web-browsing in the application column and mention all the ports in the service column (standard and non-standard ).

Hope that helps!

Thanks and regards,

Kunal Adak

[mario11584]

Thanks again for the help. I just went ahead and created a second rule with a service using the ports 60000-65000 right after the policy I mentioned previously using web-browsing. My thought is traffic for 60000-65000 won't match the previous policy but will match the very next one which contains these ports. Seems like it's working! Thanks again!