topic Re: commit status warning part II in General Topics

commit status warning part II

jdprovine — Wed, 04 Apr 2018 14:54:01 GMT

Here is another interesting commit status dependency warning

"Rule 14 application dependency warning: Application ms-update requires ssl be allowed but ssl is denied in rule 15. " Why is an application in the rule above getting on a rule below it?

Re: commit status warning part II

reaper — Mon, 09 Apr 2018 08:25:50 GMT

ms-update uses ssl to connect to the Microsoft cloud to fetch updates (dependency on ssl), when you commit, the firewall will go look where it is able to match the dependency

This warning means that the first instance of ssl it encountered is a deny rule in rule 15 so it throws a warning you may potentially be blocking a dependency that could prevent ms-update from working properly

Re: commit status warning part II

jdprovine — Mon, 09 Apr 2018 13:37:36 GMT

@reaper

so it a maybe it will maybe it won't situation

Re: commit status warning part II

reaper — Mon, 09 Apr 2018 14:05:29 GMT

it requires the admin to review as it is not a showstopper but you need to be aware, it could 'break' updates for only a section of your network for example (if you block ssl for that section)

ideally the conflict is resolved but if you have conflicting requirements (eg ssl is forbidden by policy) you may need to 'live with' the consequences

Re: commit status warning part II

jdprovine — Mon, 09 Apr 2018 15:45:38 GMT

@reaper

I guess when you can get so granular there are things you need to consider more closely before creating a rule

Re: commit status warning part II

BPry — Mon, 09 Apr 2018 20:59:50 GMT

@jdprovine,

As you get more granular you certaintly need to take into account how your existing rules will interact with the rule that you are looking to create. This could mean that you also have to seriously think about how you are ordering your rulebase to ensure that everything actually works as planned.