Wrong categorization of traffic to icmp,tracert and communication break for web traffic

Suhairul_Salleh — Fri, 27 Sep 2024 03:22:16 GMT

Hi team,

We facing issue with PA firewall that, traffic from browser or application categorized to ICMP related and match to ping enabled rule in mass.
Due to this, return traffic of the TCP session drops and application communication interrupts intermittently.

Based on our findings, the rule "Rule ID 26" which applications are set with "icmp, ping and traceroute" only in that rule.
Hence, it should not suppose to be seen as 443 by right.
Need your advice why 443 is seen under Rule ID 26 in traffic log, please?

<entry name="Rule ID 26" uuid="b57d11eb-2f12-4042-a58f-57e2351c062e">
<profile-setting>
<group>
<member>SecProfile_Outbound</member>
</group>
</profile-setting>
<from>
<member>DMZ</member>
</from>
<to>
<member>Untrust</member>
</to>
<source>
<member>any</member>
</source>
<destination>
<member>any</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<application>
<member>icmp</member>
<member>ping</member>
<member>traceroute</member>
</application>
<service>
<member>any</member>
</service>
<action>allow</action>

Appreciate your clarification.

Re: Wrong categorization of traffic to icmp,tracert and communication break for web traffic

Edsnow — Fri, 27 Sep 2024 03:32:18 GMT

Change the service from any to Application default in the rule id 26. That's the reason the incomplete application For port 443 is matching with that policy. Still it will allow all the icmp based applications mentioned in the rule.

topic Wrong categorization of traffic to icmp,tracert and communication break for web traffic in Next-Generation Firewall Discussions

Wrong categorization of traffic to icmp,tracert and communication break for web traffic

Re: Wrong categorization of traffic to icmp,tracert and communication break for web traffic