Clarification on App Rule - I thought I understood this

[TonyDeHart]

I recently moved a firewall into being managed by Panorama.  I setup an Application rule specifying the application as PANORAMA which includes the ports necessary (I assumed) for Panorama communications but the firewall could not be added successfully until I allowed port 3978 traffic.

The logs showed 3978 being recognized as SSL initially and being denied as it wasn't getting included in the rule.  What I don't understand or I guess I misunderstand, why isn't SSL allowed under that rule until the service is recognized as Panorama?  SSL is implicitly allowed under the PANORAMA application so I thought it was allowed initially under that rule on the ports the application supports.

What am I missing? 

I thought I understood it based on this article but this isn't how it seems to be working:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLLICA4

[TomYoung]

Thank you @dmifsud !

For whatever reason, this customer upgraded to 10.2.0 only.  Once he upgrades to the preferred release, we will check if the original rule works again.

Tom

[TonyDeHart]

What release did they fix that in (PAN-192930).  The engineer I was on the phone with before had notes he showed me from internal conversations that said it was working as intended and they didn't plan to patch/fix it.  I'd like to update him on which version this is in.

[TomYoung]

Hi @TonyDeHart ,

I googled PAN-192930 and found it "addressed" (fixed) in 10.1.6 and 10.2.2.

Thanks,

Tom

[TonyDeHart]

---

@TomYoung wrote:

Hi @TonyDeHart ,

I googled PAN-192930 and found it "addressed" (fixed) in 10.1.6 and 10.2.2.

Thanks,

Tom

---

Sorry I guess I could have done that...  Thank you!

So now the only problem is we are running 10.2.3-h4 and 10.1.9-h1 and that doesn't work.  Not sure what is fixed unless the discussion the engineer pointed out was related to this "fix" not actually being fixed.

[TomYoung]

Hi @TonyDeHart ,

Good to know.  I am waiting to hear back from the customer.

Thanks,

Tom

[PavelK]

It looks like that the issue discussed in this thread has an official KB. This is expected after upgrade to PAN-OS 10.2.

Kind Regards

Pavel