Custom Application Signature for only snmp-read

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Custom Application Signature for only snmp-read

L7 Applicator

Hi all

I have read the "Creating Custom Signature" Tech Note for PAN-OS 5.0, because I tried to create an application that only allows snmp-read. But there I was blocked by a limitation that I need at least 7 bytes.

The snmp-payload looks like the follwing:

3035020101040c746573747465737474657374a02202045c88c1c802010002010030143012060e2b0601040181c6750201020301000500

Now with a little bit more information:

30 35 02 01 --> SNMP Header

01 --> SNMP Version v2c

04 --> community name (string)

0c --> length of Community Name (in this case 12)

74 65 73 74 74 65 73 74 74 65 73 74 --> SNMP Community (in this case testtesttest)

a0 22 02 04 --> Identifier for SNMP get-request

5c 88 c1 c8 --> request id

and after the request id there is the snmp oid data.

So the only thing to match with an application signature are snmp header, version and the identifier for a get-request. In total these are 9 bytes but between thes values there is the snmp community which could be almost any length.

As a workaround I used the following pattern: (snmp-read)|\xa0220204\x

Like this I was able to save the custom application and to work around the 7 byte limitation.

But it seems that my idea was doomed to fail from the beginning because snmp-base and snmpv2 are already known applications from PaloAlto. So my custom application will never work right? Or does anyone know another possibility to only allow snmp-read request and drop snmp-write?

Thanks,

Remo

7 REPLIES 7

L4 Transporter

Your custom app shouldn't be affected by the pre-config apps unless you have specifically put those apps in your policy somewhere.  Other than that your logic looks right.

L5 Sessionator

You can try creating an application override with this application mentioned in the app override policy

L7 Applicator

But if I konfigure it this way then it doesn't matter what snmp traffic is going through. Unfortunately the application override policy will always take effect, if it is snmp-read or snmp-write.

I tried it with a rule on top of the ruleset with my custom application, but the traffic is still only regocnized as snmp or snmp-v2.

HI

I am just wondering if you have had any luck with this?   I am trying to do something similar in that I want to block snmp queries to    'public'   but coming up against the same problems, always seems to match    snmpv2 .

Thanks

Hi mattc

Unfortunately I still have this problem. It seems like there is no way when you want to create a custom application when there is already an existing one by paloalto.

But what you could try is to create a custom vulnerability signature. The custom vulnerability signatures may be have a higher priority than the applications.

Good luck,

Remo

L1 Bithead

Which context are you using?  Unknown-tcp?  That will only work for apps that are currently not IDed, so that will not work.  snmp context are not exposed at this time to customer created vuln or app-id.  You will have to submit a request to expose them.

  • 3080 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!