Best practice to write an application based policy whith some ports different from standard

[MGatti]

Hello,

I would need to write a policy to allow Oracle connection on specific servers.

Unfortunately I have some Oracle instances that don't use the standard TCP 1521 port.

How can I handle this problem writing just one rules that matches all my destination Oracle servers even if there are different port used?

Thanks for your reccomendations

Regards

[jbworley · Accepted solution]

You can create a rule (using your specific source/dest IPs and zones, add appID "oracle", then add in the specific service ports...

1. Add the app default port

2. Add in other non-standard ports for the app -OR- use a service group to hold all the custom service ports you create, and assign that group to the rule.

[nikoolayy1 · Accepted solution]

It is as @jbworley  mentioned and there are articles from palo alto for such tasks:

How to Configure a Policy to Use a Range of Ports - Knowledge Base - Palo Alto Networks

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN44CAG

How to create a new service object - Knowledge Base - Palo Alto Networks