topic L7 Inspection in General Topics

L7 Inspection

NetworkGeek — Fri, 07 Apr 2017 18:28:51 GMT

Hi All,

i migrated my asa to paloalto , but i can see that all policies are assigned service port but not appliation , so how can i get benefit from from application field ?

how can i transfer all polices from l4 to l7

Re: L7 Inspection

TranceforLife — Fri, 07 Apr 2017 18:42:05 GMT

Hi,

You can specify application based on your current ports and set in the service tab an "application-default" or "any" (less secure) option/field:

Re: L7 Inspection

BPry — Fri, 07 Apr 2017 18:45:19 GMT

@NetworkGeek to actually transfer the l4 to l7 you would need to do it more or less manually; there is no way to guarentee that a specified service actually means a given applicaiton, so those will not automatically switch over.

Re: L7 Inspection

bradk14 — Fri, 07 Apr 2017 19:40:26 GMT

did you convert manually or via the migration utility? either way, the migration utility actually has a path to assist for migrating from port based to app based by importing logs back into it and analyzing the traffic and making suggestions that you can agree to or customize.

you should also be comfortable with the idea of application shift. traffic that starts out as web-proxy more often than not changes to another app, so just something to consider depending on your approach (whitelisting and implicit deny vs blacklisting and explicit allow).

I come from an ASA background and I can tell you while there are some basic similiarities, the two are worlds apart.

Re: L7 Inspection

BPry — Fri, 07 Apr 2017 20:25:58 GMT

@bradk14 I always forget about the updated migration tool. I only used it a few times years back and it kinda blew so I've just kinda ignored it. Even at "worlds apart" it might kind of be an understatement, the thought process of administering an ASA doesn't easily switch to the PAN world.