Can't Create Rule for National Bindery Library App

[david_scott]

I work in a University, and recently our library began to use - or try to use - an app called "Able" from http://able.nationalbindery.com

We're behind a PA 2050 running 3.1.5 firmware.

The site uses an embedded Java app to communicate with a remote server. From what I can tell, the client initiates a session to dst port 80, then the server responds and all future communication happens across remote tcp port 9000 (and whatever random port the client chooses).

I can't seem to create a policy that will allow this traffic. I've created a policy from "Trust" to "Untrust" allowing "Service" tcp 80 and tcp 9000.

I've also added a policy from "Untrust" to "Trust", allowing port 9000. Nothing.

Does anyone have any experiece with this app? I can provide a pcap if necessary.

Thank you,

David Scott

Freed-Hardeman University

[bpappas]

@david.scott:

You can submit an application request via the Applipedia section of our support website:

http://ww2.paloaltonetworks.com/applipedia/

click the "tools" link and then the "submit an app" link

A packet capture from the client PC is always helpful when creating new application signatures.

-Benjamin

[david_scott]

I submitted this to applpedia just after your post. I never even received a confirmation that it had been received. Should I have?

[dieter_b]

Maybe the tcp 9000 traffic is actually client-server, but with your PC acting as server and their webserver acting as client.

If that's the case, you need some sort of "secondary connections" mechanism.

Or, if there would be only one PC the application is used from, a NAT port forwarding...