topic Re: Odd traffic going out through an application-specific security rule in General Topics

Odd traffic going out through an application-specific security rule

BSwientoniowski — Mon, 09 Nov 2020 19:39:31 GMT

I've got a rule that allows the following applications from any source in our trusted zone out to any destination in the untrust zone.

appdynamics
dns-over-https
dns-over-tls
github
ms-delve
net.tcp
ntp
ocsp
okta
paloalto-updates
paloalto-wildfire-cloud
pan-db-cloud
rtcp
service-now
skype
ssh
windows-azure
windows-push-notifications

The rule is set for application-default.

We have some legitimate traffic on our network that goes from trust to untrust with the destination port of tcp/37.

For some reason, this traffic is matching up to this rule. None of the applications in the rule list tcp/37 as a default port. Only two of those applications (skype and net.tcp) have dynamic default ports.

When the tcp/37 traffic hits this rule, the application always shows up as "insufficient-data"

I know what the traffic is - it is supposed to be the old "TIME" protocol. I've actually created a rule specific for this further down the list.

Any idea why the traffic would match up to this rule?

Re: Odd traffic going out through an application-specific security rule

BPry — Tue, 10 Nov 2020 02:34:53 GMT

@BSwientoniowski,

Whenever you have a rule allowing application-default the firewall is going to allow enough traffic to identify the application. So the rule that this traffic is hitting is, if I would have to make an educated guess, the first entry in your security rulebase from trust to untrust that is based off of app-id.

Re: Odd traffic going out through an application-specific security rule

BSwientoniowski — Tue, 10 Nov 2020 12:29:26 GMT

Thanks for the response. The rule that the traffic is hitting is actually the 4th rule in the list going from trust to untrust that is based off of app-id.

Re: Odd traffic going out through an application-specific security rule

OtakarKlier — Thu, 12 Nov 2020 23:14:37 GMT

Hello,

Also as a suggestion, please use URL filtering as well as DNS sinkholes. Will make your security posture that much better.

Regards,