Given a flow and properly written policy to allow Facebook and its myriad apps/widgets on port 80/443, other than the admin management overhead (i.e., having to open ports 80 and 443), how is what Palo Alto does different from what Checkpoint does?
This question addresses the quote below (found on the link shown).
In other words, if I allow ports 80/443 in my port policy and an application policy to allow Facebook apps only, I expect Checkpoint to be able to identify Facebook and non-Facebook traffic--then allow only the Facebook traffic and discard/block the rest. I expect Palo Alto to do the same--with the exception that the admin would not incur the management overhead of dealing with explicitly opening ports. Can someone elaborate on how Checkpoint (or any firewall that claims NG capabilities) opens "the floodgates."?
Just looking for an objective/technical answer.
I'm an eval custom as well, so I don't have an extremely detailed answer. The way that Palo Alto works is that they inspect the packets and determine that they belong to Facebook, which then gets allowed in. Other firewalls will require you to open up port 80/443, which means you either need to limit that rule to all of Facebook's IPs, or allow those ports in general.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!