Avaya ports Blocking

[SatheeshAnirudhan]

Hello,

We recently installed Avaya UCS and are currently using the Avaya Workplace application. For this setup, we configured the required security rules on our Palo Alto Networks PA-440 firewall. However, we are experiencing an issue when applying specific ports in the security policy.

We tested the following scenarios:

1. Security Rule Configuration
• When the rule is configured with Application: application-default and Service: Any, the Avaya Workplace application works correctly.
• However, when we specify ports in the service section, the application stops working.
2. Application-Based Rule
   We selected the following applications:
   Despite this, the application still does not work.
• avaya-phone-ring
• avaya-webalive
• avaya-weblive-voice
• rtmp
• sip
• ssl
• web-browsing
3. Service-Based Rule
   We also tried allowing the following ports/services:
   Even with these ports allowed, the application is still not functioning.
• 5060/tcp
• 5060/udp
• 5061/tcp
• 16384–32767/tcp
• 16384–32767/udp
• 3389/tcp
• 80/tcp
• 443/tcp

Could you please advise on the correct application and port requirements for the Avaya Workplace application.

Thanks

Satheesh

[TomYoung]

Hi @SatheeshAnirudhan ,

Kudos to you for trying L7 rules!  That is the best practice.  As you have found, this can be very challenging.  The process that has worked very well for me is as follows:

1. Create an application-based rule with application-default as the service.  This rule is your rule #2.
2. Create an application-based rule with specific ports as the service because you cannot combine application-default and specific ports in the same rule.  This rule is used for applications that use non-standard ports.
3. Create a catch-all rule to find anything that I missed.  This rule is your rule #1.

I put these 3 rules in order in the security policy.  The catch-all rule is used to identify the traffic that doesn't match the 1st 2 rules.  You can (1) mouse over the catch-all rule and use Log Viewer or you can use (2) Apps Seen column hyperlink to the Policy Optimizer to determine which traffic is not hitting the 1st 2 rules.  You modify rule 1 or 2 to include the new apps.  Repeat the process until you do not have any more hits on rule 3.

Thanks,

Tom