Dynamic TCP port APP query

ash83 — Thu, 06 Sep 2018 16:24:33 GMT

Hi community, In a situation where there is a security policy allowing: SOURCE Source IP: any Source Zone: outside DESTINATION Destination IP: public IP 1.2.3.4 -> NAT'd to private IP 10.10.10.10 (servername1) (the security policy is using the post NAT zone). The inbound NAT is also correctly configured, and NATing correctly. APP: appX -> any APP which uses tcp/dynamic ACTION allow The service provided by servername1 has to be available to the world, and it is serving APP=appX content (using dynamic tcp ports) The above scenario will efectively allow any IP to access 1.2.3.4 -> 10.10.10.10 (servername1) using APP=appX on ANY tcp port. Restricting the source IPs to some IPs, or country, continent etc is not an option, as it is a service that needs to be available to anyone on the internet. Is it not using appX -> any APP which uses tcp/dynamic a huge security risk, as a it is allowing connection on any tcp port, and this will end up taking down 10.10.10.10 (servername1) after it cannot handle any more connections? The only solution I can think off is to stop using appX in the above scenario, and try to use service (L4 instead) - which is not really a Palo Alto friendly approach. Any idea(s) would be much appreciated. Thanks.

Re: Dynamic TCP port APP query

Remo — Thu, 06 Sep 2018 19:13:37 GMT

Hi @ash83

In the security policy you could specify a service in addition to the app. This way you can restrict the detection of the app to the port(s) you specify.

Re: Dynamic TCP port APP query

ash83 — Fri, 07 Sep 2018 14:51:51 GMT

Hi vsys_remo,

What could be done if the app in use in enhanced-file-transfer?

Thanks.

Re: Dynamic TCP port APP query

Remo — Fri, 07 Sep 2018 16:11:09 GMT

@ash83 wrote:
What could be done if the app in use in enhanced-file-transfer?

Sorry, this one I don't understand. What do you want to do?

topic Re: Dynamic TCP port APP query in General Topics

Dynamic TCP port APP query

Re: Dynamic TCP port APP query

Re: Dynamic TCP port APP query

Re: Dynamic TCP port APP query