Adding ping/icmp as a service, or configure "Application Default" under service

cancel
Showing results for 
Search instead for 
Did you mean: 

Adding ping/icmp as a service, or configure "Application Default" under service

Not applicable

Simple question: Can a service for icmp/ping be created, or should I just configure "Application Default" under Service? We have ping/icmp defined under Application, but we also have specific services configured also and ping will not work, falls to the clean-up rule. It's my understanding that if you have specific applications configured that only those applications would be matched on the rule if services were setup with "Application Default", correct? 

I did read  "How Application-Default in the Rulebase Changes the Way Traffic is Matched" and that was my conclusion.

3 REPLIES 3

L7 Applicator

Hello,

Since ICMP is not having a layer-4 header on it, it will use Identifier as source port, the destination port is the ICMP Sequence Number.

Reference doc:How to Interpret ICMP Session Output on Palo Alto Networks Firewall

Hence, ICPM source and destination port numbers are random in nature and you cannot match with any custom services for this. The recommendation would be, create a separate rule for ICMP traffic (application=ping, service= application-default or any).

Hope this helps.

Thanks

L5 Sessionator

Please also look at DOC-4779.

Security Policy to Allow/Deny a Certain ICMP Type

Hope it helps.

Thanks,

Yasu

L0 Member

Thanks for the information. It works for us.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!