Adding ping/icmp as a service, or configure "Application Default" under service

[pansupport]

Simple question: Can a service for icmp/ping be created, or should I just configure "Application Default" under Service? We have ping/icmp defined under Application, but we also have specific services configured also and ping will not work, falls to the clean-up rule. It's my understanding that if you have specific applications configured that only those applications would be matched on the rule if services were setup with "Application Default", correct? 

I did read  "How Application-Default in the Rulebase Changes the Way Traffic is Matched" and that was my conclusion.

[HULK]

Hello,

Since ICMP is not having a layer-4 header on it, it will use Identifier as source port, the destination port is the ICMP Sequence Number.

Reference doc:How to Interpret ICMP Session Output on Palo Alto Networks Firewall

Hence, ICPM source and destination port numbers are random in nature and you cannot match with any custom services for this. The recommendation would be, create a separate rule for ICMP traffic (application=ping, service= application-default or any).

Hope this helps.

Thanks

[ymiyashita]

Please also look at DOC-4779.

Security Policy to Allow/Deny a Certain ICMP Type

Hope it helps.

Thanks,

Yasu

[BRACBankPLC]

Thanks for the information. It works for us.