topic Re: Applications Depends On Column - Prelogon Policies in General Topics

Applications Depends On Column - Prelogon Policies

MichaelMedwid — Sun, 18 Apr 2021 16:47:30 GMT

I am trying to setup prelogon and have a question about the sec policies described in Step 2 of this guide: https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/globalprotect-quick-configs/remote-access-vpn-with-pre-logon.html

I assume the source zone would be VPN (applied to tunnel) and the destination zone is Trusted (internal) - correct?

Then for permitted applications I added AD, DHCP, DNS and ms-update. The right column notes dependencies. But I believe that when you add the application that those dependencies are automatically added - correct? I don't need to add those manually. Does this look like all I'd need for the prelogon security policy?

Re: Applications Depends On Column - Prelogon Policies

nikoolayy1 — Tue, 20 Apr 2021 05:50:55 GMT

Some applications are Implicitly added but some need to be explicitly added. Please check :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV0CAK

When you commit the palo Alto will tell you so no worry, you will know if something needs to be explicitly added if you just pay attention.

Re: Applications Depends On Column - Prelogon Policies

BPry — Tue, 20 Apr 2021 16:34:17 GMT

@MichaelMedwid,

The firewall is only going to list app-ids that are dependent on other app-ids being allowed, and not what they implicitly use. You can go through applipedia and do some validation checks, but generally speaking you'll need to ensure that those dependent app-ids are allowed to ensure the traffic works as intended.