Implicit Applications with cotp/ms-rdp in security policies

MathewRD — Wed, 23 Oct 2019 19:17:46 GMT

Hello everyone,

Been testing some PA firewall functionality and noticed that ms-rdp has the implicit use of "cotp" defined, but the cotp application matches to a rule further down the policy list. When I review the logs, it looks like this

Am I misunderstanding having cotp as implicitly allowed by the ms-rdp application? Not sure why ms-rdp is allowed as part of the Test-RDP rule but then cotp drops down to a policy further in the list.

I could add the cotp application to the Test-RDP rule, but shouldn't Test-RDP be where cotp is getting caught already?

Thanks!

Re: Implicit Applications with cotp/ms-rdp in security policies

Mick_Ball — Thu, 24 Oct 2019 08:12:07 GMT

Hi @MathewRD .

when the tcp handshake is initiated for any application the firewall will view all policies for an explicit allow. If none are available then it will check again for any implicit allows.

i found these links helpful.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLLICA4

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV0CAK

topic Re: Implicit Applications with cotp/ms-rdp in security policies in General Topics

Implicit Applications with cotp/ms-rdp in security policies

Re: Implicit Applications with cotp/ms-rdp in security policies