topic Is it possible to turn off even layer 4 inspection for a traffic flow? in General Topics

Is it possible to turn off even layer 4 inspection for a traffic flow?

Shuttermed — Tue, 20 Feb 2018 17:13:05 GMT

I had a request to turn off not only layer 7 inspection (which I understand can be done with an application override)

but to turn off all inspection such that the flow only NATs?

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

OtakarKlier — Tue, 20 Feb 2018 17:18:25 GMT

Hello,

Do you mean only allow traffic by ports?

Please advise,

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Shuttermed — Tue, 20 Feb 2018 17:26:21 GMT

I mean to allow the traffic to be NATted but don't inspect the traffic at layer 4 say for proper sequencing and other typical layer 4 inspection. It's something I was requested to do and will likely not do. But I want to know if you even wanted to do it could you make a specific traffic like pass through like a router with NAT?

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

OtakarKlier — Tue, 20 Feb 2018 17:39:35 GMT

Hello,

I suppose you could by not adding any of hte security policies to the policy you have that allows the traffic. However I would not recommend it for security reasons.

Hope that helps.

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Remo — Tue, 20 Feb 2018 18:40:20 GMT

Create an any-any application override policy
Create an any-any-allow security policy without adding any profiles
Do not add any zone protection profiles to the zones
Create your required NAT policy
Have fun with your pretty expensive NAT router 😉

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Shuttermed — Tue, 20 Feb 2018 20:22:40 GMT

Hey - don't rub it in.

🙂

Thanks.

Re: Is it possible to turn off even layer 4 inspection for a traffic flow?

Shuttermed — Thu, 22 Feb 2018 01:02:14 GMT

And after all that - we tested at another time with another machine and got smooth live video via the PAN.

So it's looking like it could be an issue of non-guaranteed interwebs or local machine or who knows what.

But our infrastructure is way over built so it's not saturation and now not likely the PAN. So no need for

the costly NAT router. Woot.