topic Deny rules with service application-default in General Topics

Deny rules with service application-default

batd2 — Mon, 02 Mar 2020 15:23:16 GMT

It is not clearly described in documentation and I could not find a complete topic related to it. How does application:any, service:application-default behaves when apply to a “Deny” rule?

Presumably it will block the application if application is detected on a default port, but normally deny rules do not have recognised application, because of not enough packets to detect the application. How will application be detected?

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

Incomplete
Insufficient-data
unknown,
apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
apps with port not defined (e.g. icmp)

Re: Deny rules with service application-default

BPry — Mon, 02 Mar 2020 22:03:59 GMT

@batd2,

So as soon as the application is identified and the rule is matched, the firewall will take the deny action depending on the type of traffic you are blocking (reset/drop). Essentially, this rule will work exactly as you would expect it too without any issue.

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

Incomplete
Insufficient-data
unknown,
apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
apps with port not defined (e.g. icmp)

Because the application needs to be identified, the first three bullets in this list don't match anything. As for the last two bullet points, the rule works as you would expect; once the application is identified the deny action is performed by the firewall and the traffic is reset or dropped.

Re: Deny rules with service application-default

batd2 — Tue, 03 Mar 2020 10:14:54 GMT

@BPry Thank you for your quick response. That makes sense appart from "this rule will work exactly as you would expect it "

I did some more testing and looks like that traffic with unidentified AppID is just being allowed and logged as matching this rule, even though the rule has action "Deny".

So is it right to say that all unidentified AppID traffic will just be let in?

Re: Deny rules with service application-default

BPry — Tue, 03 Mar 2020 20:50:14 GMT

@batd2,

SO that's actually expected behavior. Just like in an allow rule with an app-id specified, the firewall needs to allow enough traffic to pass to actually go through the app-id process. Once the app is properly categorized, the traffic will go through the identification process again and it will match the proper security entry.