topic Palo Alto ALG (Application Level Gateway) SIP dissable just for a particular source and destination IP addresses in a Security Policy? in Next-Generation Firewall Discussions

Palo Alto ALG (Application Level Gateway) SIP dissable just for a particular source and destination IP addresses in a Security Policy?

nikoolayy1 — Wed, 02 Nov 2022 19:06:39 GMT

Hello to All,

From what I read about ALG (Application Level Gateway) functions on the Palo Alto Firewalls this function if needed is disabled globaly for the SIP default application or with application overide policy but this will stop the SIP signature matches.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEsCAK

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/disable-the-sip-application-level-gateway-alg

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004LyaCAE&lang=en_US%E2%80%A9

Is there a way to dissable the SIP ALG function not globally and not and app overide policy? Maybe it is better to create a custom ALG is the option "Continue scanning for other Applications" but if the SIP ALG disabled globally will the "Continue scanning for other Applications" work as how is this different than the real ALG functons in the firewall ?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZmCAK

Also I think that custom ports can't be open on the firewall with custom application sifnatures but I could be wrong.

Re: Palo Alto ALG (Application Level Gateway) SIP dissable just for a particular source and destination IP addresses in a Security Policy?

nikoolayy1 — Mon, 07 Nov 2022 09:51:06 GMT

I am starting to thing that redirecting a specific traffic to a firewall that is with ALG dissabled could be the best way. With Prisma Access it will be harder as then different tenants will be needed (there can't be more than one device group connected to a Prisma Access tenant) and tenant to tenant routing seems like a nightmare and this is why I opened another question just to check it https://live.paloaltonetworks.com/t5/prisma-access-discussions/prisma-access-routing-between-tenants/m-p/520317

The option "Continue scanning for other Applications" seems nice in some cases but not this one as from what I think two custom application id's need to be created and you need match something in the packet as the Control Channel App ID can't tell the Data Channel App id which dynamic port needs to be opened like the true ALG functions do and opening all ports with a port range in the Custom App ID Advanced settings is a little risky.

If someone has more knowedge about ALG functios on Palo Alto please share it with me 🙂