topic Application Dependency Warnings different between two firewalls - HELP! in General Topics

Application Dependency Warnings different between two firewalls - HELP!

stevenkadish — Wed, 08 Aug 2018 15:59:55 GMT

Hi all,

I am consolidating a lot of old, messy URL/App rules written by my predecessors. I have one rule that is the URL filtering rule for "unauthenticated" users (i.e., those that aren't identified by the User Agents.) It allows "any" appliation.

I have other rules that use application sets and custom URL filters, based on user groups. All working fine.

Now, I thought to restrict the services on the URL rules to HTTP & HTTPS. Most of our web browsing is personal, research, etc. We use very few cloud apps, and I can account for those in other rules. I don't want strange, non-standard ports using the URL rules.

When I restricted the services on the "Unauthenticated URL Policy," I caused a bunch of Application Dependency Warnings in the other URL/App rules. OK, fine. I should probably have used "application-default."

Here's my mystery. The exact same change on a different firewall, which has the exact same rules for user browsing (I actually cloned them) does NOT give me Application Depency Warnings.

I'm not saying that the two firewalls have the same rule bases. But these particular rules that I'm working with are all the same.

Can anyone explain this?

Thanks,

- Steve

Re: Application Dependency Warnings different between two firewalls - HELP!

BPry — Wed, 08 Aug 2018 16:37:12 GMT

@stevenkadish,

It's quite possible that the firewall that isn't giving you issues has another security policy higher in the rulebase that isn't causing the same application dependency issues as the traffic is already being allowed by prior rules; you'd really need to look at the entire rulebase to understand why the other one isn't throwing the same validation warnings.

Also note that application depenceny warnings can be really annoying. For instance if you allow snmpv3 it'll tell you that it depends on snmp-base, however you might never see the traffic come across as snmp-base and therefore the rule as you've configured works perfectly fine. 'Depends on' doesn't really mean that it needs to be in the security policy for that security policy to function perfectly fine.

Re: Application Dependency Warnings different between two firewalls - HELP!

stevenkadish — Wed, 08 Aug 2018 20:25:59 GMT

Hi,

Thanks for the response. I did look at the rules above the rules in question. None of them are quite the same mix of conditions, and shouldn’t be matching. I’m still pretty confused about it. Maybe once I get to my final set of rules at the end of this project it will be more clear.

Best,

- Steve