topic Re: Discuss about a question in ACE in General Topics

Discuss about a question in ACE

ThongPD — Sat, 22 Mar 2014 08:14:43 GMT

Hi,

I got a question from ACE and answered in there. But the answer was incorrect.

I don't know why. Anyone can explain this question. So please!

Thanks,

Thong.

Re: Discuss about a question in ACE

ThongPD — Mon, 24 Mar 2014 01:20:08 GMT

Hello,

Anybody help me.

Thanks.

Re: Discuss about a question in ACE

HULK — Mon, 24 Mar 2014 05:53:17 GMT

Hello ThongPD,

As per my understanding, the answer will be

1. Bittorrent traffic will be allowed.

2. SSH traffic will be denied by the device.

Explanation:

1. The Palo Alto App-ID feature will identify the application after a few transactions ( after TCP 3 way handshake, it will observe few packets to identify the application based on App-ID signature) , hence SSH and bittorrent traffic will never hit the first security rule.

2. Once the application will be identified as "Bittorrent", the sevice "any" will allow that traffic on any non-standard port.

3. After identifying the application SSH, the service "application-default" will not allow SSH application apart from the default port 22. Hence SSH on port 3333 will be dropped by the firewall.

Hope this helps.

Thanks

Re: Discuss about a question in ACE

VinceM — Tue, 25 Mar 2014 13:18:49 GMT

Hi,

No reason for ssh connexion not matching the last rule ... and to be allowed.

As ssh not running on normal port, it will not match the 2nd rule (for me service is part of trigger to know if traffic match the rule or not).

Re: Discuss about a question in ACE

HULK — Tue, 25 Mar 2014 21:48:51 GMT

Hello ThongPD,

Apologize for the confusion. I have tested this into my LAB and the result agrees with what Vince' comments. SSH should be allowed through the last rule.

Thanks