topic Re: OS 7.1 blocking telnet over SSL in General Topics

OS 7.1 blocking telnet over SSL

mikealanni — Fri, 16 Sep 2016 17:31:03 GMT

We have in-house software that uses secure-telnet port 992 and that has been blocked after the 7.1.4-h2 upgrade. I've created a rule to pass the traffic to the destenation address with any application any service but never help, the logs said reset both by internzone rule, only changing interzone rule to allow will let the application communicate. Even I did appliaction override on the SSL with destinationa port and address not helped me at all.

Please any clue how to fix this?

Mike

Re: OS 7.1 blocking telnet over SSL

TranceforLife — Fri, 16 Sep 2016 17:39:19 GMT

Hi,

What version of PAN-OS you had before?

Can you post screenshot of the policy and deny logs please.

Re: OS 7.1 blocking telnet over SSL

mikealanni — Fri, 16 Sep 2016 17:46:38 GMT

7.0.5h2

Re: OS 7.1 blocking telnet over SSL

TranceforLife — Fri, 16 Sep 2016 18:29:44 GMT

Hi,

Thanks. So your traffic is denied by default policy cause it does not match any other policy. Can you show me a policy config pls for this particular session? What was your policy before an upgrade? Did you try to create a rule with SSL app and destination port 992. I understand you have tried any any but l had strange behaviour, similar to yours. So when l created rule to be more specific it worked for me.

Re: OS 7.1 blocking telnet over SSL

mikealanni — Fri, 16 Sep 2016 19:09:23 GMT

I tried specific rule to destenation IP and a service with the port on both UDP and TCP, then tried application SSL then tried unknow-tcp and unknown-udp all togehter nothing works. my default inside to outside rule is any application with default application with profiles.

Re: OS 7.1 blocking telnet over SSL

TranceforLife — Fri, 16 Sep 2016 19:34:56 GMT

Ok. So from what l understood you have a policy inside >outside with application "any" and the service "application-default".

So PAN-OS 7.1 changes the behaviour for the policy with application-default specified. See below:

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-application-default/ta-p/75664

Your policy will allow any APPs but only on the default ports. From the logs, we can see that you have SSL as an application but 992 as a port. Default inter-zone has any any that is why it is permitting your traffic.

Thx,

Myky

Re: OS 7.1 blocking telnet over SSL

mikealanni — Fri, 16 Sep 2016 20:39:44 GMT

I think when I configure the destination by IP only the rules not match as now I put /32 on the destination IP that made the rule match