topic Re: Clarification on App Rule - I thought I understood this in General Topics

Clarification on App Rule - I thought I understood this

TonyDeHart — Tue, 06 Jun 2023 12:43:32 GMT

I recently moved a firewall into being managed by Panorama. I setup an Application rule specifying the application as PANORAMA which includes the ports necessary (I assumed) for Panorama communications but the firewall could not be added successfully until I allowed port 3978 traffic.

The logs showed 3978 being recognized as SSL initially and being denied as it wasn't getting included in the rule. What I don't understand or I guess I misunderstand, why isn't SSL allowed under that rule until the service is recognized as Panorama? SSL is implicitly allowed under the PANORAMA application so I thought it was allowed initially under that rule on the ports the application supports.

What am I missing?

I thought I understood it based on this article but this isn't how it seems to be working:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLLICA4

Re: Clarification on App Rule - I thought I understood this

kiwi — Wed, 07 Jun 2023 12:37:56 GMT

Hi @TonyDeHart ,

Could it be because application defaults is being used ?

SSL appllication default is port 443.

Kind regards,

-Kim.

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Wed, 07 Jun 2023 13:35:30 GMT

I guess I was assuming APPLICATION-DEFAULTS needs to be set to make sure it is using the correct ports for the applications as listed. I assume it is failing because of that since SSL wouldn't fail otherwise but if I add SSL and don't specify a port or application default then SSL can run on any port. Do I just need a separate rule for SSL on that specific PORT then? What's the point of the implicit applications then?

Re: Clarification on App Rule - I thought I understood this

TomYoung — Wed, 07 Jun 2023 14:35:27 GMT

Hi @TonyDeHart ,

I had the same question. Is your ssl traffic on port 443 or 3978? If it is on 3978, it should not be blocked and should application shift to panorama. If it is on 443, then it is a separate app that will need to be allowed by rule. I believe your current rule will only allow ssl on 3978 until it shifts.

PANW does not tells us what apps are required between Panorama and the managed NGFW, but they do give us this list of ports -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/reference-port-number-usage/ports-used-for-panorama.

There is a separate tcp/443 listed which seems to indicate to me that ssl needs to be added to the list of applications in your rule.

Thanks,

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Wed, 07 Jun 2023 15:46:33 GMT

I guess my question has more to do with why the Implied App isn't actually used in this case. If I have a rule that specifies PANORAMA as an application and SSL is implicit to that I don't understand why SSL isn't allowed automatically and needs to be explicitly allowed in the rule itself.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Wed, 07 Jun 2023 16:12:42 GMT

Hi @TonyDeHart ,

SSL is only implicitly allowed until the NGFW identifies the application as panorama. Here are explanations of the cases from the URL you posted:

Case 1: SSL traffic is allowed by rule and still alowed when it shifts to sharepoint-online.
Case 2: SSL traffic to www.example.com is allowed temporarily but denied because it never shifts to sharepoint-online.
Case 3: SSL traffic to www.facebook.com is allowed temporarily but denied after it shifts to facebook-base.

This is the desired behavior as we do not want a L7 rule allowing also panorama to allow all ssl. We want it to allow only the selected application.

Thanks,

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Wed, 07 Jun 2023 16:16:54 GMT

So why doesn't CASE 1 apply here? It is SSL traffic and then shifts to PANORAMA was my assumption here. Not doubting your answer just trying to understand as that was how I was reading it - the SSL is implicitly allowed until identified and what I see in the logs is this initial SSL communications on 3978 and then the shift to PANORAMA.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Wed, 07 Jun 2023 16:28:24 GMT

Hi @TonyDeHart ,

The ssl traffic that you see being denied. Is it port 443 or 3978?

Thanks,

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Wed, 07 Jun 2023 16:52:43 GMT

It is on port 3978 but now that I've sat on this a while and looked at the logs again, it appears there may be legitimate SSL traffic on 3978 as not all the traffic is identified as Panorama. Some it appears to be remaining as SSL over the long term. When I had initially set this up the SSL was switching over to Panorama so I assume it was ALL identified a Panorama but there appears to be a good deal of both here. Just seems strange to me that Panorama's own traffic wouldn't be identified as just that and not generically as SSL.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Wed, 07 Jun 2023 16:57:07 GMT

Hi @TonyDeHart ,

Yes, that is strange. Looking at the URL I posted with the ports, I would think you would need to allow SSL on 443 as well.

Thanks,

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Thu, 08 Jun 2023 19:16:15 GMT

Interestingly, to add to this, traffic from other firewalls to Panorama is properly tagged as Panorama traffic and NOT SSL.

Palo support is scratching their head over this too so I now don't feel so bad. If I find out what's going on I'll post it here.

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Mon, 12 Jun 2023 20:26:39 GMT

After some conversation with Palo support it turns out there are situations now with 10.2 and above that Panorama traffic is NOT identified as Panorama and is only identified as SSL traffic. According to Palo Alto support, this requires that SSL on 3978 be EXPLICITLY allowed for communications with Panorama. Supposedly, this was originally identified as a bug some time ago but for technical reasons has to be this way. A rule with SSL/PANORAMA on port 3978 is necessary.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Fri, 16 Jun 2023 14:27:30 GMT

Hi @TonyDeHart ,

I just had a customer upgrade his Panorama to 10.2 and this change in App-ID BROKE his existing rule which only had the panorama App-ID. We had to create a new rule allowing ssl on tcp/3978. The NGFW was also upgraded to 10.2.

It was working before, but the upgrade broke the connectivity to the remote NGFWs. I quickly looked through the 10.2 known issues, and I did not find this bug.

Thank you for the info!

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Fri, 16 Jun 2023 11:15:38 GMT

Glad it helped!

Re: Clarification on App Rule - I thought I understood this

dmifsud — Sat, 17 Jun 2023 09:34:08 GMT

PAN-192930	Fixed an issue where, when the default port was not TCP/443, implicitly used SSL applications were blocked by the Security policy as an SSL application and did not shift to the correct application.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Mon, 19 Jun 2023 21:26:44 GMT

Thank you @dmifsud !

For whatever reason, this customer upgraded to 10.2.0 only. Once he upgrades to the preferred release, we will check if the original rule works again.

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Mon, 26 Jun 2023 12:54:12 GMT

What release did they fix that in (PAN-192930). The engineer I was on the phone with before had notes he showed me from internal conversations that said it was working as intended and they didn't plan to patch/fix it. I'd like to update him on which version this is in.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Mon, 26 Jun 2023 12:57:08 GMT

Hi @TonyDeHart ,

I googled PAN-192930 and found it "addressed" (fixed) in 10.1.6 and 10.2.2.

Thanks,

Tom

Re: Clarification on App Rule - I thought I understood this

TonyDeHart — Mon, 26 Jun 2023 13:12:31 GMT

@TomYoung wrote:

Hi @TonyDeHart ,

I googled PAN-192930 and found it "addressed" (fixed) in 10.1.6 and 10.2.2.

Thanks,

Tom

Sorry I guess I could have done that... Thank you!

So now the only problem is we are running 10.2.3-h4 and 10.1.9-h1 and that doesn't work. Not sure what is fixed unless the discussion the engineer pointed out was related to this "fix" not actually being fixed.

Re: Clarification on App Rule - I thought I understood this

TomYoung — Tue, 27 Jun 2023 04:09:48 GMT

Hi @TonyDeHart ,

Good to know. I am waiting to hear back from the customer.

Thanks,

Tom