topic Re: Problem with incomplete application in General Topics

Problem with incomplete application

Register_Security — Tue, 13 May 2014 01:40:16 GMT

Hi all,

I have the same problem with incomplete application.

!Public zone! <====> PAN Firewall <====> INSIDE Firewall <-----> Server IP.

I have nated Server IP to Public ip, and configure rule like the below.

Name: (Ping) ; Src zone: (public); Src: (any); Dst zone: (any) ; Dst (any); Appliccation: (icmp, ping) ; Action: (ALLOW);

I monitor traffic on PAN Firewall, I saw the traffic : Application is INCOMPLETE and action is ALLOW corresponding to the above "Ping" rule, and on my INSIDE Firewall, I also saw the traffic with the same public IP address to my server.

I real don't know why is traffic pass into my INSIDE Firewall.

Please help me to deny all of incomplete traffic.

Thanks so much.

Re: Problem with incomplete application

jvalentine — Tue, 13 May 2014 01:46:46 GMT

Did you permit ping on "any" service/port? You should never use "any" for service/port on incoming rules. You should only use "application-default" or a specified port.

Re: Problem with incomplete application

HULK — Tue, 13 May 2014 01:56:49 GMT

Hello,

It's looking like a routing issue for me. Let me know if i understand it correctly.

NAT Policy:

Source-zone=Public Zone,

Destination-zone= Public zone

Destination IP address: Public IP address

NAT destination translation= Private address of the Server

Security Policy:

Source-zone=Public Zone,

Destination-zone= Inside Zone ( LAN)

Routing:

a) Default gateway on PAN FW pointing towards Public zone ISP router.

b) Server's Private IP address >>>pointing towards next hop to INSIDE FW

Thanks

Re: Problem with incomplete application

HULK — Tue, 13 May 2014 02:02:11 GMT

Hello Jared,

I think any session based firewall will match the ICMP session based on ICMP Identifier, and the ICMP Sequence, to create the sessions. Hence, ideally there will be no default port for ICMP protocol, ultimately it will be "ANY".

Thanks

Re: Problem with incomplete application

Register_Security — Tue, 13 May 2014 02:41:17 GMT

Thanks Hulk, I wonder how I block all of incomplete application.

Hi Jared,

I don't know where to configure application-default, please shared your idea in this case.

Thanks so much.

Re: Problem with incomplete application

jvalentine — Tue, 13 May 2014 04:22:52 GMT

Please post a screenshot of the security policy that permits ping.

Re: Problem with incomplete application

Gregoux — Tue, 13 May 2014 08:54:36 GMT

Hi all

for me it's look like a routing issue or something avoid the return of ping echo.

if you you want to deny incomplete flow, you need to let pass the first packet icmp in your case and wait for an response that cross again the firewall to be define as ping application however if the response is not seen then the flow will be categorize as incomplete.

in fact you cannot block incomplete flaw in your case unless you deny ping application or if you resolve your routing issue.