topic Re: Why is this traffic allowed when the rule should not allow it? in General Topics

Why is this traffic allowed when the rule should not allow it?

RobinClayton — Wed, 04 Jul 2018 14:53:28 GMT

I am tidying up some rules that were "rush" jobs as part of the initial deployment.

One rule "TEST-VI" was

SRC ZONE - TRUST
DST ZONE - Partners
DST Addr - I%%%%%A-VIP

Application - Any

I was going to get rid of this as there is another rule after it with "Service 20,988,5678" which would be a better match.

But when I looked at the tracffic for the rule "TEST-VI"

???I see traffic going in both directions "Trust -> Partners" but also "Partners -> Trust"???

The NAT rule matches the sources and destinations.

Source (Trust) = 128.%.%.22
Dest (Trust) = 128.%.%.244
Source Translated = 192.%.%.111
Dest Translated = 192.%.%.254

Why is the security rule allowing the traffic Partner to Trust??

Is it just the perculiarity of the firewall knowing "FTP" creates new return sessions and these are allowed logged? I can't see anything in the opposite direction for the other services.

Thanks

Rob

Re: Why is this traffic allowed when the rule should not allow it?

LukeBullimore — Wed, 04 Jul 2018 15:12:29 GMT

Hi @RobinClayton

You're correct with your comment "Is it just the perculiarity of the firewall knowing "FTP" creates new return sessions and these are allowed logged? I can't see anything in the opposite direction for the other services."

It is the way that the firewall is creating "predict" sessions for FTP ALG.

https://live.paloaltonetworks.com/t5/Learning-Articles/Palo-Alto-Networks-Firewall-Session-Overview/ta-p/55633

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/app-id/application-level-gateways

As a "workaround" to this, you can create an Application-Override policy for the FTP traffic which would in turn disable FTP ALG.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-an-Application-Override-for-FTP/ta-p/58420

Thanks,

Luke.

Re: Why is this traffic allowed when the rule should not allow it?

RobinClayton — Wed, 04 Jul 2018 15:35:40 GMT

Ahh good, that means I should be good to disable the bad rule and leave the correct rule and ALG to do the job.

Thanks

Rob