Application specific and port any

[ghostrider]

Hello Experts

Is it OK to to put application specific and port any in the security policy, specially if ports are dynamic like SQL DB?

Regards,

GR

[bmorris1]

Hi Ghostrider,

That completely depends on what your buisness requirements are. If you are using MS-SQL then the standard ports are tcp/1433, udp/1433. MySQL is  tcp/3306. Check which data base you are using and what ports it is configured to use. Ideally you would want the security policies to be locked down so you only allow the traffic you need/want to.

hope this helps,

Ben

[ghostrider]

Actually what I mean some application uses dynamic ports. In this case, I need to make service any? there is any ALG concept on Palo Alto?

[TranceforLife]

Hello,

Sure there is and MySQL is on a list ;

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/app-id/application-level-gateways

Thx

[ghostrider]

Thanks. So for example MySQL is using dynamic ports then what I need to allow in the policy? for sure application MySQL (which I am supposing allow on default ports) and what about service? what I would select any or default ports and ALG will take care of dynamic port?

Appreciated your reply

[TranceforLife · Accepted solution]

l would try to use app as MySQL with default ports in the services. If your MySQL app configured to use initially a defaul port firewall will allow a dynamically requested ports, similar way to FTP

[ghostrider]

Thank you and make sense !