topic Re: gotoassist application recognition in General Topics

gotoassist application recognition

dieter_b — Thu, 19 Dec 2013 16:22:47 GMT

Is anyone else having issues with PA not recognizing gotoassist very well ?

Citrix documentation expects you to open tons of DNS addresses and/or IP ranges, but I'm a bit wary of opening ALL traffic on ports 80 and 443 to these (most IP ranges are on Amazon btw) since we're heavily relying on application identification.

Re: gotoassist application recognition

Phoenix — Thu, 19 Dec 2013 16:39:05 GMT

Hello Dieterb,

Citrix software gotoassist works on the ports 80/443. If the services are made "App default" it uses the ports needed to have the gotoassist traffic allowed. Now in the apps column since we have added gotoassist it looks for signature pattern of gotoassit with combination of ports needed. If this combination matches only then traffic is allowed. If just ports match and signature pattern is not allowed the traffic should not be permitted.

Thanks

Re: gotoassist application recognition

dieter_b — Thu, 19 Dec 2013 16:57:18 GMT

That's indeed how our rules are setup:

We use an application group to allow several remote support applications, service application-default

For these applications, no user-id required (user: any)

from zone trust to zone untrust

Basic security profile applied, but that should not block legitimate traffic (will check in threat log)

What I do notice, is some traffic gets recognized as citrix-jedi and gotomeeting, those are very similar to gotomeeting. And they are allowed too.

Threre's really no clear line to draw. It's one of those apps that use generic ports randomly, to many different ip's randomly ...

Re: gotoassist application recognition

Phoenix — Thu, 19 Dec 2013 18:01:57 GMT

Hello dieterb,

Yes it may be possible sometimes to see the apps as citrix-jedi and gotomeeting and so on. Sometimes when the software product change a certain behavior for gotoassist in this case, if it is not updated on PAN app signature we may see such issues. And also all of these belong to same parent company there may be overlaps as seen below.

In such cases, where config looks like gotoassist is allowed but citrix-jedi app is not allowed then while passing traffic if we see some part of gotoassist identified as citrix-jedi and it is getting rejected then we may experience traffic drops..to avoid such issues we may have to open a case to correct the app signature database.

Re: gotoassist application recognition

dieter_b — Fri, 20 Dec 2013 10:41:56 GMT

I've put all similar citrix application and even more in the allow policy, but still no go.

I'll probably have to allow services http and https. But I'll try to limit the domains and/or ip's that are actually used (not the entire list of all Citrix SaaS products).

Not sure if PA can do anything about it in the application definitions...