Application vs Service in PA

nsrini1991 — Sun, 15 Jul 2018 04:01:21 GMT

Hi Experts,

I've query in Application vs Service columns. As we all know the Palo Alto preferred method is to use Application column (SSL, Web-browsing) and refer to 'Application default' in Service.

My query is, if we mark 'ANY' in Service column and filter the ports in Application column (SSL, Web-browsing) will PA firewall stop further processing and allow the traffic by looking @L4 or will the inspection be continued for application layer. Please assist.

Regards,

Srinivasan

Re: Application vs Service in PA

Remo — Sun, 15 Jul 2018 07:29:17 GMT

Hi @nsrini1991

If you set the service to 'any' the firewall continues to inspect traffic at the application layer, but this will allow ssl and web-browsing really on ANY port.

Almost all applications have a default port assigned, but this will only be enforced if you configure 'application-default' as service. This also means you cannot really filter for ports just with applications in your policy. The service column is also required to achieve the required result. (Except if you really want to allow web-browsing/ssl (or others) on ANY port, then of course ANY as service is the appropriate decision)

topic Re: Application vs Service in PA in General Topics

Application vs Service in PA

Re: Application vs Service in PA