topic Re: Custom Application Signature to only allow snmp-read in Automation/API Discussions

Custom Application Signature to only allow snmp-read

Remo — Wed, 12 Nov 2014 12:59:36 GMT

Hi all

I have read the "Creating Custom Signature" Tech Note for PAN-OS 5.0, because I tried to create an application that only allows snmp-read. But there I was blocked by a limitation that I need at least 7 bytes.

The snmp-payload looks like the follwing:

3035020101040c746573747465737474657374a02202045c88c1c802010002010030143012060e2b0601040181c6750201020301000500

Now with a little bit more information:

30 35 02 01 --> SNMP Header

01 --> SNMP Version v2c

04 --> community name (string)

0c --> length of Community Name (in this case 12)

74 65 73 74 74 65 73 74 74 65 73 74 --> SNMP Community (in this case testtesttest)

a0 22 02 04 --> Identifier for SNMP get-request

5c 88 c1 c8 --> request id

and after the request id there is the snmp oid data.

So the only thing to match with an application signature are snmp header, version and the identifier for a get-request. In total these are 9 bytes but between thes values there is the snmp community which could be almost any length.

As a workaround I used the following pattern: (snmp-read)|\xa0220204\x

Like this I was able to save the custom application and to work around the 7 byte limitation.

But it seems that my idea was doomed to fail from the beginning because snmp-base and snmpv2 are already known applications from PaloAlto. So my custom application will never work right? Or does anyone know another possibility to only allow snmp-read request and drop snmp-write?

Thanks,

Remo

Re: Custom Application Signature to only allow snmp-read

ssharma — Wed, 12 Nov 2014 13:15:31 GMT

Yes, that is correct, if firewall already has an application. Custom application for device's application has some issues working on the device. If you need this feature, you can contact our DevCenter at following link :

DevCenter

They will be the best resource to assist you with this requirement. Hope this helps. Thank you.

Re: Custom Application Signature to only allow snmp-read

hshah — Wed, 12 Nov 2014 14:23:48 GMT

Hi Axi,

Let me know if following article is useful.

https://live.paloaltonetworks.com/message/13669#13669

Regards,

Hardik Shah

Re: Custom Application Signature to only allow snmp-read

hshah — Wed, 12 Nov 2014 14:28:57 GMT

Hi AXI,

PANW allows only Read only SNMP, please refer following "tech note" for more details.

Using the Simple Network Management Protocol (SNMP)

Regards,

Hardik Shah

Re: Custom Application Signature to only allow snmp-read

Remo — Thu, 13 Nov 2014 08:33:15 GMT

Hi Hardik

Unfortunately I am not allowed to access this article.

I know that PaloAlto only allows snmp-read to the firewall itself. My idea was for other systems which are located in a zone behind the PaloAlto Firewall.

Regards,

Remo