active-directory-base application isn't match traffic when services/URL Category is set to "application-default" in security rule

[Ouattara]

Hello,

I use a Firewall at version 10.0.8-h8. I wrote a rule to allow the application "active-directory-base" (which contains several ports) in the application section then "application-default" in the services/URL category section as recommended by PA.

The observation I made is that the flow never matches this rule. It is even dropped by the inter-zone rule.

When I change "application-default" by "any" in the services/URL category table, it works fine.

Do you have an explanation for this behavior?

#strata 

[reaper]

do the ports used by the sessions match the default ports listed in active-directory-base 

Standard Ports:  

tcp/1025-5000, tcp/135,138,139,389,445,464,636, tcp/49152-65535, tcp/5722,9389, udp/88,123,137,138,389,445,464,2535

and did you allow the dependencies in another rule?

Depends on:  

kerberos, ms-ds-smb-base, ms-netlogon, netbios-dg, netbios-ns, netbios-ss