I am new to the world of PA and next gen firewalls and took some online training. I discovered that in the Traffic Proccessing phase before App ID gets applied in the Security Policy that the session is already allowed to start if the layer 4 ports are allowed in the policy. This makes me wonder if I were to run a port scan on my public address or telnet to a specific port that I would still be able to find out if its open using those same old tricks. In my mind since all the telnet trick does is send a SYN packet to the IP address I'm troubleshooting than the PA should still be able to send back a SYN ACK for the port I'm checking thus letting me know if its open or not. I understand that the point of App ID is to prevent hackers from using any application they want over a default port (e.g using http over port 22) but in theory if the session is allowed to start before App ID kicks in then I can still telnet to port 80 to see if its open just like I always have. Is this true or am I way out in deep space nine?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!