topic Re: Application vs Services in General Topics

Application vs Services

KrishnanR — Sun, 11 Oct 2020 07:17:35 GMT

Hi Team,

I have a couple of questions in application vs services.

1. I have to permit a list of services for a particular traffic. In those list some of them are already in the applications like DNS, IMAP, Pop3 and I need to create some services with custom port. Now do I add these applications and the custom services in the same rule or does it have to be in two different rules ?

2. I need to permit bitdefender/kaspersky antivirus traffic. As per the application it uses only tcp 80/443 as standard port. But I do have a list of services which has custom ports like tcp 7075. Do i need to add as a service or add as an application and give any (instead of application-default) ?

Please advise.

Re: Application vs Services

Abdul-Fattah — Sun, 11 Oct 2020 15:21:39 GMT

Hi,

1- You can add the application and all ports to same rule, as the application wont be identified based on the port it uses but here you will have to allow all services like also 53, 143...

2- you can choose the application and set service to any, that should work but not best practice.

Re: Application vs Services

KrishnanR — Mon, 12 Oct 2020 08:53:29 GMT

Hi Abdul,

Thanks for your reply.

Now If I add applications for eg DNS, then do i need to allow 53 as well ? Then If I permit 53 in service and I need to permit some customer service like 7010, then I will be adding 7010 as well. WIll the application DNS be looking for service 7010 as well ? or how is the behavior ?

Re: Application vs Services

Abdul-Fattah — Mon, 12 Oct 2020 10:09:51 GMT

Hi @KrishnanR,

you will need to add all ports that the applications will use because in the services tab "Selected" will be set.

each application will use the ports it needed, DNS works on normally on Port 53, so it will use this port.

Re: Application vs Services

KrishnanR — Wed, 14 Oct 2020 07:33:58 GMT

Thanks for your message.

If I have a list of applications like dns, https along with some services like TCP-7010(not related to dns or https), these applications have no relation with the services I am going to mention. So should it be in a single policy ?

Re: Application vs Services

Abdul-Fattah — Wed, 14 Oct 2020 07:50:17 GMT

well that depends how you will organize your security policies, so when you search for a policy your created before it will make sense to the admin.

Re: Application vs Services

KrishnanR — Wed, 14 Oct 2020 08:06:33 GMT

Dear Abdul,

Thanks for your reply. I mean can I add them both in a single policy itself rather than creating two different policies one for App-ID and another for Services related. Will that be fine or that may cause any issue ?

Re: Application vs Services

Abdul-Fattah — Wed, 14 Oct 2020 08:30:52 GMT

Application and services are handled seperatly, that means you will need to list all applications that you need, and all services that you need. an example if the traffic has been identified as Facebook:Port 80,443, then application tab should list facebook and services set to selected then services will need to list all ports that facebook will need. another exmple if the firewall identified the traffic as Unknown TCP:Port 7010, and application tab lists Unkown-tcp, but services selected and port 7010 not listed, the traffic wont match the rule.

hope now it is more clear.

Re: Application vs Services

KrishnanR — Wed, 14 Oct 2020 08:52:05 GMT

Dear Abdul,

Thanks for your quick response. So in the same rule, I can add these. This will work ?

I saw the following rule in the demo system. It means in a single rule it should be fine I guess

Re: Application vs Services

Abdul-Fattah — Wed, 14 Oct 2020 09:44:52 GMT

no that will not work, because services is selected and only 4001 is allowed, when selected you will need to enter all port that you want to allow or deny that means the dns port.....

Re: Application vs Services

KrishnanR — Wed, 14 Oct 2020 10:45:12 GMT

But if you look at the rule which I saw in demo appliance it had ping and other applications with a custom service.

Re: Application vs Services

Abdul-Fattah — Wed, 14 Oct 2020 11:59:06 GMT

ping doesnt need a port, and for ms-rdp probably they are using NAT or even 3389 defined in same TCP4001. as i already mentinied that is how security policy in PA works.

good luck.