topic Re: gmail-base without smtp, pop3, imap applications in General Topics

gmail-base without smtp, pop3, imap applications

RudolfTorvenyi — Tue, 01 Apr 2014 12:20:04 GMT

Hello,

I don't really get the application dependency. I had a case at my customer. They asked me to allow gmail-base application, so I made security policy. But when I committed the settings a popup appeared that told me that additional applications should be allowed.

Like smtp, imap, pop3, ssl. But I don't want to allow them. How can I do this?

thanks

Re: gmail-base without smtp, pop3, imap applications

RudolfTorvenyi — Tue, 01 Apr 2014 12:58:20 GMT

The only way is to paste a Deny rule that drops all smtp, imap, and pop3. Is that right?

Re: gmail-base without smtp, pop3, imap applications

prb — Tue, 01 Apr 2014 13:32:31 GMT

Yes you can go ahead and configure a deny rule to drop smtp, imap, and pop3.

You don't need them normally for gmail-base, unless you have a specific requirement.

Re: gmail-base without smtp, pop3, imap applications

HULK — Tue, 01 Apr 2014 14:15:47 GMT

Hello RudTor,

There is different way to access gmail.

1. Through a web-browser.

2. Through imap, smtp, pop3 mail client ( Example-microsoft outlook)

To access through browser, only ssl ( for https://gmail.com --- port 443) and web-browsing ( http://gmail.com----port 80) will be enough as a dependent application. Need not to allow all dependent applications unless you are using it.

Explain your customer, if he only wants to access gmail through a browser, then he can allow SSL and web-browsing application along with gmail-base. He can safely ignore the dependency warning for smtp, pop3 and imap.

Here is an example, while i am accessing https://gmail.com through a browser.

Hope this helps.

Thanks

Re: gmail-base without smtp, pop3, imap applications

RudolfTorvenyi — Tue, 01 Apr 2014 14:29:36 GMT

Hello Hulk,

thank you. But if I make a security policy to allow only web-browsing and ssl, the gmail-base will be dropped. And if I add to this policy gmail-base, a dependency warning appears by commit.

Re: gmail-base without smtp, pop3, imap applications

HULK — Tue, 01 Apr 2014 14:37:13 GMT

Hello RudTor,

This is expected. If you make a security policy to allow only web-browsing and ssl, then gmail-base traffic will be dropped. Once you will add Application=gmail-base on that security policy, you can safely ignore the dependency warning for smtp, pop3 and imap.

Thanks

Re: gmail-base without smtp, pop3, imap applications

RudolfTorvenyi — Tue, 01 Apr 2014 14:51:12 GMT

thank you Hulk.

Ok, but after I add the gmail-base application without the other applications smtp, imap, pop3, I will get the warning every time I make the commit ?

Thanks

Re: gmail-base without smtp, pop3, imap applications

HULK — Tue, 01 Apr 2014 15:05:45 GMT

Hello RudTor

Could you please let me know the PAN-OS and Application database version running on your device. I am using PAN OS 6.0.1 and not getting any warning, even if i have only gmail-base and ssl application added into the policy. ( As per my knowledge, 5.0.x onwards the warning message will not appear during commit)

FYI:

Thanks

Re: gmail-base without smtp, pop3, imap applications

RudolfTorvenyi — Tue, 01 Apr 2014 15:14:38 GMT

Hello,

Its PANOS 6.0.1.

Re: gmail-base without smtp, pop3, imap applications

RudolfTorvenyi — Tue, 01 Apr 2014 15:22:13 GMT

Hulk,

I think that you don't get any warning because of your rule nr.2 where you are allow any to any

Re: gmail-base without smtp, pop3, imap applications

HULK — Tue, 01 Apr 2014 15:25:11 GMT

Hello RudTor,

I am sorry, in my case there was a any any=Allow policy and that is why it was not showing any warning. Now i am also getting the same warning message.

Thanks