Application and services in security policy rules

[jatin.singh06]

Hi I have a question,

Following rule,

Application allowed- DNS,SSL,WEB-Browsing

Service allowed - TCP port 22

I understand DNS, SSL and Web-browsing would be allowed on port 22, but my question is SSH  traffic  would be allowed by this rule as I am allowing port-22 via service.?

Also My second question, would DNS traffic  be allowed on its standard  port 53 via this rule?

My understanding is Palo matches Both Services and Application together, hence SSH traffic would be blocked in this case and DNS traffic on port 53 would  also be blocked?

Referring this article - https://live.paloaltonetworks.com/t5/blogs/what-are-applications-and-services/ba-p/342508

[OtakarKlier]

Hello,

Correct, you will need to have ssh in the application field to allow the traffic. You will not need a 'service'/port since that is implied in the application.

https://applipedia.paloaltonetworks.com/

Regards,

[Sec101]

It would be nice if you could get away with an "and"  for app default- AND any port you specify in the rule. 

[OtakarKlier]

Hello,

You absolutely can. However the point with the applications is that you dont have to. So instead of a policy that is like:

application = ssh and service = 22/tcp, you can just put in application = ssh.

Thats really it. The firewall knows and can see ssh and knows its only allowed on port 22/tcp by default.

Hope that helps.

[Sec101]

I was under the impression that one rule was either app-default OR you pick the service.

Like
app=ssh

service
app-default OR tcp/22  

[jatin.singh06]

So that means.

Lets says I allowed 5 applications in my rule 1 with "application-default"

The traffic from that rule would be allowed on all standard ports.

Now I have another non standard port to allow.

So I have to make another rule and allow ALL apps on that TCP- NON-STANDARD  port.

Does'it not open up all application traffic on that port.

Would'nt it be better if I use the non standard port in same rule 1 and somehow palo allows my 5 applications on their standard ports and also the non standard I added in services section.

That way I can have the traffic going to non standard port allowed and also applications to standard ports allowed in same rule.

That poses less secuirty risk rather than allowing all apps on that non standard port in a new rule?

@OtakarKlier @reaper