topic Re: Looking for a way to allow an application without allowing all dependencies with no commit warni in General Topics

Looking for a way to allow an application without allowing all dependencies with no commit warnings

JoshuaBolin — Mon, 13 Feb 2017 16:15:32 GMT

Issue background:

We have a policy for Application Whitelist of allowed applications on the internet firewall. SourceForge-Base is one of these applications. SourceForge-Base had dependencies on SSL, Web-Browsing, and SSH. We allow SSL and Web-Browsing, but do not wish to allow SSH to the entire outbound internet. Our users traffic works fine with only SSL and Web-Browsing being allowed in conjunction with SourceForge-Base when they access SourceForge.

Without knowing the IP ranges utilized by SourceForge to allow that in a separate policy by service port, (also without utilizing SSL decryption so an FQDN is not an option), we have no way to allow the traffic other than by application.

Is there a way to hide or suppress persistent application dependency warnings in specific so that a commit can come back without warnings?

Or is there a way to allow SSH only if it is used in conjunction with SourceForge-Base, as in SSH being an Implicit Use Application for SourceForge-Base?

Re: Looking for a way to allow an application without allowing all dependencies with no commit warni

reaper — Tue, 14 Feb 2017 10:33:13 GMT

Hi Joshua

The dependency warning will remain as the dependency has not been met

You could create a security policy that allows ssh only to a custom category containing all the URL's used by sourceforge:

this is slightly different from URL filtering as it uses the category as a layer 3 destination match rather than url filtering

alternatively, if you know the sourceforge servers, you could add FQDN objects to the destination

Re: Looking for a way to allow an application without allowing all dependencies with no commit warni

jvalentine — Wed, 15 Feb 2017 20:35:11 GMT

There's an existing feature request for this capability. Please reach out to your Palo Alto Networks Systems Engineer so your request can be tracked.

Re: Looking for a way to allow an application without allowing all dependencies with no commit warni

nextgenhappines — Wed, 15 Feb 2017 20:47:11 GMT

@jvalentine Can you provide the FR#? That will save so much time for my SE.

Re: Looking for a way to allow an application without allowing all dependencies with no commit warni

jvalentine — Wed, 15 Feb 2017 21:46:17 GMT

Depending on the exact use case, I'd look at: 1887, 2689, 4131