topic Re: Application vs Service in General Topics

Application vs Service

bhelman — Mon, 21 Mar 2011 16:32:50 GMT

I have a server that I can create a rule with Applications (e.g web-browsing, ssl), but I also need to open up specific ports (e.g udp-20). Do I need to create 2 separate rules (ie are the Application/Service fields an "and") or can I use 1 rule (Application/Service fields are "or"). Right now, I have one policy, but the traffic is still being blocked and the Monitor is giving me "not-applicable" for the Application (specifically, the application is icmp and yes, I have icmp listed as an Application).

The new policy isn't the one Monitor is flagging the traffic as not-applicable. The new policy is rule470 but Monitor is saying icmp is being blocked at rule269. Rule269 is my LAST policy. rule470 allows icmp and ping as well as some services.

Re: Application vs Service

reaper — Mon, 21 Mar 2011 17:04:52 GMT

the application and service field share an "and" relationship

you can add an application and then set the service to limit for example http to only port 80 (preventing http over 8080 and other ports)

in your example you should create 2 rules, one for the applications, and one for the service

traffic categorised as not-applicable is not categorised because it is dropped due to it not hitting an allow rule

Re: Application vs Service

bhelman — Mon, 21 Mar 2011 17:50:55 GMT

Thank you. I'm breaking them out now.