topic Re: Service port to application help in General Topics

Service port to application help

ghostrider — Sat, 22 Oct 2016 21:17:16 GMT

Hello Experts

We migrated Juniper netscreen firewall to PA. I am just struggling to make application based policies. User just send the ports to make security policies. Like:

1- Allow port tcp 1549 on mysql db

2- Allow https://ebs:8000

How I can handle this to put application only?

Kindly help me with best practice with PA

Regards,

Re: Service port to application help

nextgenhappines — Sat, 22 Oct 2016 23:56:44 GMT

Just create a policy with application and service as those specific port (application any, service tcp1549), run it for few hours|days|weeks and review the traffic log to check what application(s) are getting identify. Once you are comfortable, create another rule with those application(s) identify and service port (for example, application mysql, service tcp 1549 {since mysql default port is tcp 3306}) and place the newly created specific application rule on the existing application any, service specific port rule. Check again if the newly created rule missed any application and repeat the process until you are comfortable, and disable the service only rule.

Re: Service port to application help

ghostrider — Mon, 24 Oct 2016 10:12:54 GMT

You are the man ! So If I understand correctly, the "specific application - rule", I need to put above the "any application - rule" and see if "any application - rule" still getting hit? If not then I can delete this. Right?

Re: Service port to application help

nextgenhappines — Tue, 25 Oct 2016 14:18:52 GMT

@ghostrider That is correct. Hope this helps..

Re: Service port to application help

ghostrider — Wed, 26 Oct 2016 16:19:30 GMT

thank you