topic Re: Application specific and port any in General Topics

Application specific and port any

ghostrider — Mon, 24 Oct 2016 11:29:36 GMT

Hello Experts

Is it OK to to put application specific and port any in the security policy, specially if ports are dynamic like SQL DB?

Regards,

Re: Application specific and port any

bmorris1 — Mon, 24 Oct 2016 12:35:25 GMT

Hi Ghostrider,

That completely depends on what your buisness requirements are. If you are using MS-SQL then the standard ports are tcp/1433, udp/1433. MySQL is tcp/3306. Check which data base you are using and what ports it is configured to use. Ideally you would want the security policies to be locked down so you only allow the traffic you need/want to.

hope this helps,

Ben

Re: Application specific and port any

ghostrider — Mon, 24 Oct 2016 14:55:35 GMT

Actually what I mean some application uses dynamic ports. In this case, I need to make service any? there is any ALG concept on Palo Alto?

Re: Application specific and port any

TranceforLife — Mon, 24 Oct 2016 15:02:46 GMT

Hello,

Sure there is and MySQL is on a list ;

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/app-id/application-level-gateways

Thx

Re: Application specific and port any

ghostrider — Mon, 24 Oct 2016 15:05:47 GMT

Thanks. So for example MySQL is using dynamic ports then what I need to allow in the policy? for sure application MySQL (which I am supposing allow on default ports) and what about service? what I would select any or default ports and ALG will take care of dynamic port?

Appreciated your reply

Re: Application specific and port any

TranceforLife — Mon, 24 Oct 2016 15:10:30 GMT

l would try to use app as MySQL with default ports in the services. If your MySQL app configured to use initially a defaul port firewall will allow a dynamically requested ports, similar way to FTP

Re: Application specific and port any

ghostrider — Mon, 24 Oct 2016 20:53:51 GMT

Thank you and make sense !