topic Re: Best practice to write an application based policy whith some ports different from standard in General Topics

Best practice to write an application based policy whith some ports different from standard

MGatti — Wed, 12 Jan 2022 16:09:15 GMT

Hello,

I would need to write a policy to allow Oracle connection on specific servers.

Unfortunately I have some Oracle instances that don't use the standard TCP 1521 port.

How can I handle this problem writing just one rules that matches all my destination Oracle servers even if there are different port used?

Thanks for your reccomendations

Regards

Re: Best practice to write an application based policy whith some ports different from standard

jbworley — Wed, 12 Jan 2022 19:55:25 GMT

You can create a rule (using your specific source/dest IPs and zones, add appID "oracle", then add in the specific service ports...

1. Add the app default port

2. Add in other non-standard ports for the app -OR- use a service group to hold all the custom service ports you create, and assign that group to the rule.

Re: Best practice to write an application based policy whith some ports different from standard

nikoolayy1 — Thu, 13 Jan 2022 08:25:07 GMT

It is as @jbworley mentioned and there are articles from palo alto for such tasks:

How to Configure a Policy to Use a Range of Ports - Knowledge Base - Palo Alto Networks

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN44CAG

How to create a new service object - Knowledge Base - Palo Alto Networks