topic Re: Best Practice: Allowing a known application together with a custom service. in General Topics

Best Practice: Allowing a known application together with a custom service.

jeroenverstraeten — Fri, 17 May 2019 12:52:06 GMT

Let's say we have 2 zones seperated by our PA firewall, Zone A and Zone B. Traffic between Zone A and Zone B is only allowed for some applications/services from dedicated devices in Zone A to dedicated devices in Zone B.

We have a custom Service which uses TCP port 7777 named CustomService1.

Device 1 in Zone A needs to access Device 2 in Zone B on our custom service AND by https. Is this possible in 1 rule?

Or do we need to configure this like:

Re: Best Practice: Allowing a known application together with a custom service.

OGMaverick — Fri, 17 May 2019 13:14:42 GMT

2 rules is going to be an OR. If you want it to match an application & port, they need to be within the same rule. Everything you match on in the same rule is an AND.

If you do those 2 seperate rules, it's going to allow ALL web browsing traffic on its default ports(80/443) as well as allow all traffic, web browsing or not, over tcp port 7777. You could test the single rule requiring both app web-browsing/ssl & your custom service.

Re: Best Practice: Allowing a known application together with a custom service.

kiwi — Fri, 17 May 2019 13:28:08 GMT

Hi @jeroenverstraeten ,

Yes you can combine applications with non-standard ports in one single rule :

What-s-a-service-anyway

Cheers !

-Kiwi.