topic Security policy using wildcard destinations and NON http/https protocols in General Topics

Security policy using wildcard destinations and NON http/https protocols

TiborNad — Fri, 23 Aug 2019 07:16:30 GMT

Dear community

We are dealing with a request for a firewall rule which is supposed to allow SMB traffic (TCP 445) to a wildcard destination like *.subdomain.example.com out on the internet. So this made me think about how we should implement such a rule and I am not even sure it can be done or at least I don't know how. If this would be HTTP/HTTPS traffic we could create a customer URL category in order to be used in a rule with an allow action. But when the protocol isn't HTTP/HTTPS but something like SMB or SSH and so on, I don't think the URL category will be a factor. Also creating a FQDN object is not an option since it won'd allow wildcards.

Any other ideas or suggestions from your side? Many thanks and regards

Tibor

Re: Security policy using wildcard destinations and NON http/https protocols

Mick_Ball — Fri, 23 Aug 2019 09:25:23 GMT

if using internal DNS with an external forwarder it would be possible to log all requests/responses for *.subdomain.example.com and forward these via API to a dynamic address group on the PA.

not for me.... but it is an option...

Re: Security policy using wildcard destinations and NON http/https protocols

TiborNad — Fri, 23 Aug 2019 11:33:32 GMT

Thank you very much. This is a interesting option I would never have considered. Your input is very much appreciated.

Any other suggestions? Or can someone confirm my feeling that URL categories will not have any impact at all?

Re: Security policy using wildcard destinations and NON http/https protocols

Mick_Ball — Fri, 23 Aug 2019 18:20:58 GMT

The Url categories are determined by http “Get” command so no chance... the only other time url cats will kick in is when perhaps something like smtp traffic is encrypted via tls. palo will then use certificate details to guess the category Just like undecrypted https traffic.

wildcards cannot be used in fqdn as palo turns your string into a regex kinda dns search... the search criteria is within square brackets and cannot include some special characters such as an asterisk.

Sorry wouldnot acept unencrypted but it has now...