Application Logmein identified but not dropped by rulebase

d_aznar — Wed, 29 Feb 2012 15:35:38 GMT

Hello,

Sorry, but I hav implemented a brand New PAN solution with Url cat and AV license.

All configuration works find. I have a visitor zone on a DMZ and I want them to access Internet but with my Url Categorisation, so I can't let them use Remote access application.

I Have implemented a rulebase with

[...]

Name "Rule 30"

Src Zone "DMZ"

Src "DmzUserNetwork-1" & "DmzUserNetwork-2 "

Dst Zone "Internet"

Dst "Any"

Application: "Logmein" & "tcp-over-dns" & application group "peer-to-peer" => App-group have all filtered apps with catégorie p2p

Profil "None"

Action Drop

Name "Rule 50"

Src Zone "DMZ"

Src "DmzUserNetwork-2"

Dst Zone "Internet"

Dst "Any"

Application "Any"

Profil "Service Group MyProtectedPol" (=> AV, Url-cat, and Malware rules)

Action Allow

[...]

The point is that from a device connected in DmzUserNetwork-2, when I try to connect the web browser to logmein service, PAN Monitor show me an allowed connexion based on rule 50. Rule 30 is Enabled, and placed before Rule 50. It seems that the firewall doesn't applied denied rule. Note that I have already commited config and saved.

Do you have any suggestions?

Thanks, BR.

Re: Application Logmein identified but not dropped by rulebase

d_aznar — Thu, 01 Mar 2012 10:10:01 GMT

Hello Team,

Seems that upgrade from 4.1.1 to 4.1.3 resolved the case.

No changes on the rulebase. But now, the Ref "Rule 30" drop rule is correctly interpreted and logmein trafic is dropped.

BR,

David

topic Application Logmein identified but not dropped by rulebase in General Topics

Application Logmein identified but not dropped by rulebase

Re: Application Logmein identified but not dropped by rulebase