topic Re: Security Policy is passing the service which is not configured in policy. in General Topics

Security Policy is passing the service which is not configured in policy.

MPESDC — Mon, 31 May 2021 15:53:42 GMT

We have created a VPN to Trust rule for just FTP and SSH Service for server in which we have Allowed only those services with application any. But the some of the traffic is passing with the some random service port with the same rule with application ftp which is not mention in security policy. Any Idea why is this happening.

Re: Security Policy is passing the service which is not configured in policy.

Remo — Mon, 31 May 2021 16:20:34 GMT

Hi @MPESDC

This is a special case for the application ftp. In an initial ftp connection the actual data transfer port is sent in the payload of the controlconnection. The firewall reads this and opens the additional port dynamically. This is at least the explanation for this behaviour so far.

I see it here probably as you do. If you have specified exactly one port, the firewall should not allow dynamically another one - even if this breaks the ftp connection. In this situation I recommend to open a TAC case for either finaly clarification or informing them about this behaviour.

Re: Security Policy is passing the service which is not configured in policy.

nikoolayy1 — Mon, 31 May 2021 19:31:28 GMT

You may check this article and your app configuration and you can you use app overide to not only to allow passive FTP but lso to block it:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFeCAK

Re: Security Policy is passing the service which is not configured in policy.

OtakarKlier — Tue, 01 Jun 2021 18:29:41 GMT

Hello,

As a best practice, I would recommend you use the Application rather than the port.

Regards,