topic Re: Issues with service and applications in rules in General Topics

Issues with service and applications in rules

scottoliver — Wed, 15 Aug 2018 22:23:09 GMT

Is or has anyone else had the problem with applications and services being ignored in rules? I have had an issue from all version from 7.0 to 8.1. I have stopped using applications in rules all together because it will not identify the application and instead mark it as "not-applicable". I have the problem with services as well. For example I will create a rule and everything is 100% correct and I will add the service UDP 137 to the rule instead of netbios and it will still drop the **bleep** traffic. What good is a firewall if it doesnt allow the services you tell it to? I cant allow any any any on rules. This is becomming very frustrating.

Re: Issues with service and applications in rules

santonic — Thu, 16 Aug 2018 12:50:13 GMT

You're doing something very wrong. Applications and services (and combination of both) in rules work perfectly.

Can you share some examples?

Re: Issues with service and applications in rules

scottoliver — Sun, 19 Aug 2018 01:15:22 GMT

I promise this is not me. I have had this issue for a while now over several versions. I will create a rule 100% correct source and destination zones and addresses. I will first create the rule using an application for example dns. If the Palo is unable to determine the application it will identify as "incomplete" or "not-applicable" and will drop the dns traffic. So I will create a rule under it I will remove the application and I will create a new service or use an existing one. For dns I will add TCP and UDP 53. I will then push the config. Traffic still gets dropped. This doesnt happen all the time but enough so its a problem.

Re: Issues with service and applications in rules

Remo — Sun, 19 Aug 2018 10:57:43 GMT

Hi @scottoliver

As @santonic already wrote there is probably something wrong in you är config (even if you promise that it isn't your fault 😛 ). Application incomplete could also have (many) other reasons that the firewall not working properly. Could you share screenshots of the security policy and of a working and nit working connection in your log? Additionally may I ask what PAN-OS version and app version do you have installed?

Re: Issues with service and applications in rules

santonic — Mon, 20 Aug 2018 05:36:41 GMT

Can you please post a DNS rule and a detailed log entry of a traffic dropped.

Re: Issues with service and applications in rules

RobinClayton — Mon, 20 Aug 2018 08:23:48 GMT

HAve you got any rules further up the chain that block?

Try your new rule right at the top of the chain instead.

Re: Issues with service and applications in rules

Remo — Sat, 25 Aug 2018 21:52:08 GMT

@scottoliver

Were you able to solve the issue?