topic Re: Application Filters and dependencies - General Internet Use in General Topics

Application Filters and dependencies - General Internet Use

KarlVallis — Tue, 06 Aug 2019 12:56:24 GMT

I've been following the instructions here: https://live.paloaltonetworks.com/t5/Blogs/What-are-the-recommended-applications-for-internet-access/ba-p/153835, on setting up applications filter for controlling internet access. I've configured the application filter, and applied it to my security policy, but I receive a lot of dependency warnings when I validated the commit.

Is there a better way to deal with the dependencies rather then manually adding them to a application group and applying it to the policy?

Re: Application Filters and dependencies - General Internet Use

BPry — Tue, 06 Aug 2019 17:24:04 GMT

@KarlVallis,

The validation process is kind of 'dumb' when you split things up into different application groups or different security policies, and there isn't much that you can do about it. Unless you go through and address the validation issues you can't supress them or anything like that, but depending on your security model they can usually be safetly ignored as long as it's simply the validation logic that is causing validation errors to be reported.

PAN-OS 9.0 made some changes so that the validation process becomes a lot more streamlined, but I currently wouldn't recommend you run 9.0 in a production environment unless you absolutely need to for one of the new features it adds.

Re: Application Filters and dependencies - General Internet Use

jeremy.larsen — Wed, 07 Aug 2019 16:35:07 GMT

Currently only specific "well known" applications handle the dependecies for you. For many you will need to include them in the rule.