topic Re: How to check not detected open or allowed ports in service rule policy in Next-Generation Firewall Discussions

How to check not detected open or allowed ports in service rule policy

giozapa — Wed, 28 Feb 2024 18:31:54 GMT

Hi, Any idea if there is a tool to trace in PA5220 to check the un-detected open or allowed ports in rule policy.

For example from a source IP 192.168.x.x.x. to a destination public IP (web server) . In the service I only specify port 443 but upon checking there are a lot of open ports that were allowed. This poses a security vulnerability in my network.

Any help would be much greatly appreciated. A thousand thank you in advance 🙂

Re: How to check not detected open or allowed ports in service rule policy

Claw4609 — Wed, 28 Feb 2024 19:04:58 GMT

Hello,

First thought would be its either hitting a different rule or the service object is incorrect. If you look at the service object is the destination set to 443. Heres and example of the pre-defined one:

Otherwise it may be hitting a different rule. You can test example traffic and see which rule it would hit. If you for to Policies>Security at the bottom there is a test policy match where you can enter information and see what rule it would hit.

Re: How to check not detected open or allowed ports in service rule policy

giozapa — Wed, 28 Feb 2024 19:23:52 GMT

A thousand thank you @Claw4609 . Done specifying the 443 part the only thing I have not tried is testing the policy match, seems I can do this temporarily but there is another platform that can detect that is capable of collecting, searching and analyzing the open/allowed ports that were not detected on the Palo fw.