topic Re: Application Dependency in General Topics

Application Dependency

RyanA. — Fri, 18 Jul 2014 16:45:13 GMT

Hello

We currently block access to Scribd for our employees. We now want to allow Scribd and I was looking through the Applipedia and noticed "scribd-base" but it also has dependencies of "web-browsing" and ssl". If I add those dependencies will they permit ALL web-browsing (tcp 80) and ssl (443) traffic? Or will it be just limited to scribd-base?

Thank you

Re: Application Dependency

kadak — Fri, 18 Jul 2014 17:46:37 GMT

Hello Ryan,

If you are using PANOS 5.0 and above you wouldn't be required to include dependent applications in the security policies.

Here is the document that explains the same:

How to Check if an Application Needs to have Explicitly Allowed Dependency Apps

Hope that helps!

Thank and regards,

Kunal Adak

Re: Application Dependency

RyanA. — Fri, 18 Jul 2014 18:56:52 GMT

Hi Kadak

Thank you for the link, very helpful!

We are on PAN OS 5.0.12

After reviewing the linked article and checking the implicit-use-applications list for Scribd, there are no apps listed. Therefor I would need to explicity allow web-browsing and ssl along with the scribd-base. In doing so, will the policy open up access to all websites that are identified as web-browsing and ssl? Or will the policy just apply when the user visits scribd.com?

THank You

Re: Application Dependency

HULK — Fri, 18 Jul 2014 19:19:12 GMT

That will widely open up all traffic, categorized as web-browsing and SSL.

Thanks

Re: Application Dependency

ET — Fri, 22 Aug 2014 16:09:49 GMT

HULK is right,

Therefore PaloAlto is unable to allow a specific Application explicitly if it has dependencies, without allowing the dependencies as well.

There are many applications that are depends on web-browsing and ssl and allowing them would create a big "hole"