topic Re: Rule has application any and port 3389 we see discard for application cotp in General Topics

Rule has application any and port 3389 we see discard for application cotp

MP18 — Fri, 22 Nov 2019 14:08:39 GMT

We have security policy to allow any application on port 3389.

I see users are able to connect to server on port 3389.

traffic log shows denied on application cotp.

my understanding is that if you have application as any it should cover all the applications.

why it is getting denied on app cotp for port 3389?

Running PAN os 8.1.9

Re: Rule has application any and port 3389 we see discard for application cotp

fjwcash — Fri, 22 Nov 2019 21:02:37 GMT

In the Traffic log, add the Rule column, and see which Security Policy is matching the allowed traffic, and which Security Policy is matching the denied traffic. From the sounds of it, there's two separate policies in play here.

Re: Rule has application any and port 3389 we see discard for application cotp

MP18 — Sun, 24 Nov 2019 16:54:57 GMT

Check the traffic logs when ms-rdp is allowed on port 3389 it hits the right rule

when i see application cotp on port 3389 i see hitting default default deny rule.

strange behaviour as application in rule is any on port 3389

Re: Rule has application any and port 3389 we see discard for application cotp

Remo — Sun, 24 Nov 2019 18:31:51 GMT

Hi @MP18

Add the protocol column to your logview. I am pretty sure that the denied connections are udp connections and you have added only 3389/tcp to your security rule, right?

RDP primary tries to establish a connection on udp because of performance reasons and if this is not possible there is a fallback to tcp which is the reason that your connections work (port 3389/tcp) but you still have deny logs on (port 3389/udp).

Re: Rule has application any and port 3389 we see discard for application cotp

MP18 — Sun, 24 Nov 2019 19:18:13 GMT

Yes i only have added port 3389-tcp on the security rule.

I can see deny on udp connection on port 3389.

I also deny on application cotp on tcp port 3389 and it does not hit the rdp rule.

application cotp denied on port 3389 tcp does not make sense to me.

Seem application ms-rdp uses Implicitly Uses: cotp, t.120??

Re: Rule has application any and port 3389 we see discard for application cotp

Remo — Sun, 24 Nov 2019 19:21:53 GMT

I agree that this does not make sense, as long as the source really hits your RDP rule. Another idea I do not have right now.

Did you do a security policy match test on the cli (or in WebUI if you already are on PAN-OS 9) with exactly the same connection details as the dropped connections? And does it then match your RDP rule?

Re: Rule has application any and port 3389 we see discard for application cotp

MP18 — Sun, 24 Nov 2019 19:37:42 GMT

here is test from cli

i am running pan os 8.1.9

(active)> test security-policy-match from CorpData_INT to Pay_Prod_DMZ application ms-rdp source 10.63.44.68 destination 10.29.33.34 protocol 6 destination-port 3389

(active)> test security-policy-match from CorpData_INT to Pay_Prod_DMZ application cotp source 10.63.44.68 destination 10.29.33.34 protocol 6 destination-port 3389

(active)>

i see no output

Re: Rule has application any and port 3389 we see discard for application

ChrisVee — Wed, 06 May 2020 23:34:25 GMT

Did you end up resolving this ?

PANOS 8.1.12 App content 8264-6059 installed.

Was working last week.

Now I log into a client site and instead of ms-rdp , my traffic is blocked cotp as the app-id. Confirmed its TCP traffic.

I prefer not to just add cotp to my security policy, since that doesn't really fix the problem just works around it and adds something I'm not condoning at this point.

Re: Rule has application any and port 3389 we see discard for application

ChrisVee — Thu, 07 May 2020 00:18:58 GMT

Resolved !

So it wasn't any content change, in the end or anything, it was due to someone removing my access to the destination via RDP in the past week with user-id restrictions on the destination.

This resulted in the policy-deny to take place, but still, the odd thing is the App-id recognised ONLY in the deny messages is cotp.

Once I corrected the group membership and my user-id was allowed in, the app-id was recognised as ms-rdp correctly.

Hope this helps someone else. Maybe something to correct from a firewall traffic log standpoint, this would have streamlined troubleshooting if the traffic was blocked and the app-id read ms-rdp as expected.

Re: Rule has application any and port 3389 we see discard for application cotp

ms9221 — Thu, 07 Nov 2024 19:44:31 GMT

you rock!