Can we create a rule to match only the selected application without selecting WEb-Browsing dependency

PauloVenancio — Wed, 12 Jul 2023 07:36:05 GMT

Dear All,

I need a community advice, we are migrating all our Firewalls from Checkpoint to Palo Alto.

First Palo Alto was implemented 2 weeks ago, a PA 3420 version 10.2.4-h2

We are trying to transform the imported rules into Palo alto style.

For example I want to create a rule to allow only access to "TeamViewer" application for some computers but not allowing them to browse internet.

So, first I implemented the SSL decrypt rule for thoses computers, decrypt is running fine.

I create the filtering rule with Source = computers Ip's and Destination= TeamViewer application

When I do that there are suggested applications dependency's that are SSL and Web-Browsing, so I add them also into the allowed Applications list. (Seem to be a best practice doing that)

But when I do this, the effect of this rule is that these computers can actually browse the whole Internet, not just TeamViewer.

So I read on some other posts that to filter correctly I should add an url list with (teamviewer.com and *.teamviewer.com) to the rule to filter only the Application teamviewer.

But, so what's the point to use application if in parallel I have to combine them with Url list ?

Because I could instead create a URL List based rule only (without speechifying the Application) i will have the same effect ?

Many thanks for your advices.

Regards

Re: Can we create a rule to match only the selected application without selecting WEb-Browsing dependency

SutareMayur — Tue, 25 Jul 2023 15:59:59 GMT

Hi @PauloVenancio ,

If teamviewer is using its default port i.e. TCP/UDP 5938 then, it would be easier for you to filter traffic based on the destination port along-with app-id. But anyway, if teamviewer can't connect over default port, it will next try to connect over 443.

Coming to your questions-

But, so what's the point to use application if in parallel I have to combine them with Url list ?

-Most of admins use all the available options to restrict their security policies. So it will be good idea to use URL list in your case.

Because I could instead create a URL List based rule only (without speechifying the Application) i will have the same effect ?

-Yes, that will also work based on the destination URLs allowed under the list.

topic Can we create a rule to match only the selected application without selecting WEb-Browsing dependency in Next-Generation Firewall Discussions

Can we create a rule to match only the selected application without selecting WEb-Browsing dependency

Re: Can we create a rule to match only the selected application without selecting WEb-Browsing dependency