topic Re: SMB URI Filtering (Custom Applications) in General Topics

SMB URI Filtering (Custom Applications)

apackard — Tue, 25 Jan 2011 14:23:33 GMT

I'm wondering if it is possible to define an 'application' based on an SMB URI path?

Example - I have two shares on a SMB SAN server \\san\public and \\san\secret; is it possible to apply a firewall rule to a Palo device that sits between this server and clients such that access to the shares can be restricted based the destination path, not just the server identity/IP?

The intent is that this would supplement the core ACL functionality on the datastore, serving as a failsafe way of restricting access to network storage in the event that inappropriate ACL rights are granted in error.

Thanks

Re: SMB URI Filtering (Custom Applications)

mharding — Tue, 25 Jan 2011 16:26:48 GMT

I don't believe we have access to the SMB decoder to create an application like that.

Re: SMB URI Filtering (Custom Applications)

gafrol — Tue, 25 Jan 2011 17:06:55 GMT

At least PAN claims to be able to scan smb traffic for virus. This implies they have a decoder for smb or am I wrong ?

rgds

Roland

Re: SMB URI Filtering (Custom Applications)

mharding — Tue, 25 Jan 2011 17:14:44 GMT

They do.

https://live.paloaltonetworks.com/docs/DOC-1716

Re: SMB URI Filtering (Custom Applications)

James — Tue, 25 Jan 2011 19:05:44 GMT

Hi There,

The SMB decoder is currently not available for configuration like the HTTP decoder.

Please contact your local sales team (that'll be me ) to file a feature request apackard.

Thanks

James