topic Re: discrepancy regarding web-browsing ports between applipedia and Pan-OS application in General Topics

discrepancy regarding web-browsing ports between applipedia and Pan-OS application

Carracido — Mon, 11 Dec 2023 16:09:01 GMT

Dear community!

Did you notice that there´s an discrepancy regarding web-browsing ports between applipedia and Pan-OS application?

If you check for web-browsing details in the firewall you see standard port 80 and secure port 443.

In the applipedia you can see only standard port 80 associated to the web-browsing application:

This can be misleading if you trust the applipedia, because actually when you create a rule with web-browing and service = application-default the traffic will match this rule on ports 80 and 443.

Have you ever checked with Palo Alto about this fact?

Re: discrepancy regarding web-browsing ports between applipedia and Pan-OS application

OtakarKlier — Mon, 11 Dec 2023 19:18:12 GMT

Hello,

Could be a simple mistake on their part, I would say open a case and see where it takes you.

Regards,

Re: discrepancy regarding web-browsing ports between applipedia and Pan-OS application

Brandon_Wertz — Wed, 13 Dec 2023 13:53:28 GMT

It's not a mistake, it's a further detail.

Re: discrepancy regarding web-browsing ports between applipedia and Pan-OS application

Brandon_Wertz — Wed, 13 Dec 2023 13:57:55 GMT

The answer to your question is related to SSL decryption. I do though think that applipedia should match what the FW's description says.

The reason the FW says the "secure port" for web-browsing is 443 is because when you do SSL Interception and the traffic is just general web-browsing the initial application is "SSL" which is 443/tcp. Then once SSL Interception is successful the traffic sees an application shift and app SSL moves to "web-browsing." If the traffic is something more specific like HBO or Netflix, the application would shift to that, but you'll see web-browsing over 443/tcp with SSL interception.

Re: discrepancy regarding web-browsing ports between applipedia and Pan-OS application

GrzegorzRakus — Sun, 06 Oct 2024 19:18:26 GMT

I know this topic is a bit old, but it seems that the web-based Applipedia does not show the full information about the applications compared to the Objects > Applications in WebUI
About Secure-Ports in App-ID, quoting from Beacon training:
"Starting with the PAN-OS 9.0 release, the application-default service setting has been extended to allow certain SSL-encrypted applications on their default SSL secure ports, in addition to the application’s standard ports."
and
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/application-default