OS 7.1 blocking telnet over SSL

Reply
Highlighted
L2 Linker

OS 7.1 blocking telnet over SSL

We have in-house software that uses secure-telnet port 992 and that has been blocked after the 7.1.4-h2 upgrade. I've created a rule to pass the traffic to the destenation address with any application any service but never help, the logs said reset both by internzone rule, only changing interzone rule to allow will let the application communicate.  Even I did appliaction override on the SSL with destinationa port and address not helped me at all.

 

Please any clue how to fix this?

 

Mike

L6 Presenter

Re: OS 7.1 blocking telnet over SSL

Hi,

 

What version of PAN-OS you had before? 

Can you post screenshot of the policy and deny logs please.

 

 

L2 Linker

Re: OS 7.1 blocking telnet over SSL

7.0.5h2

Untitled.png

L6 Presenter

Re: OS 7.1 blocking telnet over SSL

Hi,

 

Thanks. So your traffic is denied by default policy cause it does not match any other policy. Can you show me a policy config pls for this particular session? What was your policy before an upgrade? Did you try to create a rule with SSL app and destination port 992. I understand you have tried any any but l had strange behaviour, similar to yours. So when l created rule to be more specific it worked for me.

L2 Linker

Re: OS 7.1 blocking telnet over SSL

I tried specific rule to destenation IP and a service with the port on both UDP and TCP, then tried application SSL then tried unknow-tcp and unknown-udp all togehter nothing works. my default inside to outside rule is any application with default application with profiles.

L6 Presenter

Re: OS 7.1 blocking telnet over SSL

Ok. So from what l understood you have a policy inside >outside with application "any" and the service "application-default".

 

So PAN-OS 7.1 changes the behaviour for the policy with application-default specified. See below:

 

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-applicati...

 

Your policy will allow any APPs but only on the default ports. From the logs, we can see that you have SSL as an application but 992 as a port. Default inter-zone has any any that is why it is permitting your traffic.

 

Thx,

Myky

L2 Linker

Re: OS 7.1 blocking telnet over SSL

I think when I configure the destination by IP only the rules not match as now I put /32 on the destination IP that made the rule match

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!