topic Re: Adding ping/icmp as a service, or configure "Application Default" under service in General Topics

Adding ping/icmp as a service, or configure "Application Default" under service

pansupport — Tue, 24 Jun 2014 00:34:37 GMT

Simple question: Can a service for icmp/ping be created, or should I just configure "Application Default" under Service? We have ping/icmp defined under Application, but we also have specific services configured also and ping will not work, falls to the clean-up rule. It's my understanding that if you have specific applications configured that only those applications would be matched on the rule if services were setup with "Application Default", correct?

I did read "How Application-Default in the Rulebase Changes the Way Traffic is Matched" and that was my conclusion.

Re: Adding ping/icmp as a service, or configure "Application Default" under service

HULK — Tue, 24 Jun 2014 01:04:47 GMT

Hello,

Since ICMP is not having a layer-4 header on it, it will use Identifier as source port, the destination port is the ICMP Sequence Number.

Reference doc:How to Interpret ICMP Session Output on Palo Alto Networks Firewall

Hence, ICPM source and destination port numbers are random in nature and you cannot match with any custom services for this. The recommendation would be, create a separate rule for ICMP traffic (application=ping, service= application-default or any).

Hope this helps.

Thanks

Re: Adding ping/icmp as a service, or configure "Application Default" under service

ymiyashita — Tue, 24 Jun 2014 07:07:33 GMT

Please also look at DOC-4779.

Security Policy to Allow/Deny a Certain ICMP Type

Hope it helps.

Thanks,

Yasu

Re: Adding ping/icmp as a service, or configure "Application Default" under service

BRACBankPLC — Thu, 31 Mar 2022 17:49:16 GMT

Thanks for the information. It works for us.