Rule Scenario 80/443 vs using ssl/web-browsing

clyde.franklin — Wed, 30 Aug 2017 18:14:55 GMT

HI in what Rule Scenario woulld 80/443 vs using ssl/web-browsing be used. And why wouldnt app for ssl and web-browsing not work but prot 80/443 work

Re: Rule Scenario 80/443 vs using ssl/web-browsing

fjwcash — Wed, 30 Aug 2017 20:58:37 GMT

"web-browsing" and "ssl" only match generic HTTP/HTTPS traffic. If the firewall determines a more precise App-ID for the traffic, then it will switch to using that for determining whether to allow/deny the traffic, which may fail in mysterious ways. 🙂

For example, if you have a general "allow web traffic" Security Policy and use "web-browsing" in the rule, then very basic web traffic will be allowed. But, if someone accesses GMail, or Facebook, or Youtube, or click on a video link in a generic web page, than the firewall will notice and match that traffic to the google-base, or google-mail, or facebook-base, or youtube, or streaming-video App-ID, none of which are listed in the rule, and block the traffic. Which leads you down a rabit hole of "access website, check logs for what app is shown, update rule, keep browsing, rinse and repeat". 🙂

We ran into this issue trying to get regular ol'Moodle courses working correctly using application matching. Once the list got beyond 6 or 7 difference applications, we switched to just allowing straight port 80/443 traffic through.

There are situations where the application matching really helps (video conferencing, for example), and situations where it really doesn't (a general "allow web traffic" rule). It depends on how specific you need the rule to be.

Re: Rule Scenario 80/443 vs using ssl/web-browsing

Raido_Rattameister — Fri, 01 Sep 2017 13:15:12 GMT

Instead of opening port 80/443 create application filter to dynamically group applications together and add filter into the rule.

Objects > Application Filters

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/app-id/create-an-application-filter

topic Re: Rule Scenario 80/443 vs using ssl/web-browsing in General Topics

Rule Scenario 80/443 vs using ssl/web-browsing

Re: Rule Scenario 80/443 vs using ssl/web-browsing

Re: Rule Scenario 80/443 vs using ssl/web-browsing