topic Re: Can't Create Rule for National Bindery Library App in General Topics

Can't Create Rule for National Bindery Library App

david_scott — Wed, 11 May 2011 19:15:34 GMT

I work in a University, and recently our library began to use - or try to use - an app called "Able" from http://able.nationalbindery.com

We're behind a PA 2050 running 3.1.5 firmware.

The site uses an embedded Java app to communicate with a remote server. From what I can tell, the client initiates a session to dst port 80, then the server responds and all future communication happens across remote tcp port 9000 (and whatever random port the client chooses).

I can't seem to create a policy that will allow this traffic. I've created a policy from "Trust" to "Untrust" allowing "Service" tcp 80 and tcp 9000.

I've also added a policy from "Untrust" to "Trust", allowing port 9000. Nothing.

Does anyone have any experiece with this app? I can provide a pcap if necessary.

Thank you,

David Scott

Freed-Hardeman University

Re: Can't Create Rule for National Bindery Library App

bpappas — Wed, 11 May 2011 19:19:24 GMT

@david.scott:

You can submit an application request via the Applipedia section of our support website:

http://ww2.paloaltonetworks.com/applipedia/

click the "tools" link and then the "submit an app" link

A packet capture from the client PC is always helpful when creating new application signatures.

-Benjamin

Re: Can't Create Rule for National Bindery Library App

david_scott — Tue, 17 May 2011 20:26:09 GMT

I submitted this to applpedia just after your post. I never even received a confirmation that it had been received. Should I have?

Re: Can't Create Rule for National Bindery Library App

dieter_b — Wed, 18 May 2011 10:13:53 GMT

Maybe the tcp 9000 traffic is actually client-server, but with your PC acting as server and their webserver acting as client.

If that's the case, you need some sort of "secondary connections" mechanism.

Or, if there would be only one PC the application is used from, a NAT port forwarding...