topic Re: Clarification on Application and Service in security policy in Next-Generation Firewall Discussions

Clarification on Application and Service in security policy

IBM-MSS — Thu, 31 Aug 2023 14:59:00 GMT

Hi,

By restricting the security policy with specific application and allow ANY service leads to allow all traffic through that policy?

Re: Clarification on Application and Service in security policy

BPry — Thu, 31 Aug 2023 15:06:37 GMT

@IBM-MSS,

Yes, and also not really ... but also yes ... but primarily no 😀

What happens in that situation is that the firewall needs to allow enough traffic to pass to actually identify the application, so your rule will capture a whole lot more traffic than your actual intent. That being said, as soon as the firewall can identify the application and it isn't what you have specified the traffic will no longer match the rule and continue to be analyzed according to the rest of your security rulebase.

I'd generally recommend being heavily cautious when you're creating these sort of policies, and make them as restrictive as reasonably possible. You are allowing traffic to pass to identify the actual application, there's no way around that when creating a policy like this.

Re: Clarification on Application and Service in security policy

IBM-MSS — Thu, 31 Aug 2023 16:14:55 GMT

Thanks for the clarification.

During my investigation, i identified that telnet and netmap traffic is allowing through this policy. I believe this is because service will check on Layer 3 and Application will check on layer 7.

Re: Clarification on Application and Service in security policy

Raido_Rattameister — Thu, 31 Aug 2023 16:25:42 GMT

If you test connectivity with telnet then firewall sees TCP 3way handshake and as there is no application traffic yet it will be permitted.

You could set up some dummy rule to collect those incompletes and this avoids your app rule to match other traffic.

This example works well for that purpose as ping is not actually TCP application and it never matches to outgoing pings 🙂