connection interrupt

[panos]

Hi,

An internal application is used for databese.It's default port is 5520

when we saw this behaviour we wrote an application override rule for that tcp port and named a new application.

after that we saw issue behaviour not changed(user is disconnectet from application sometimes, not everytime) but from logs we saw 2 applications match this traffic.

that was strange.if byte is big it is seen other app.

if it is small it see our app id which we created.

any ideas ? thanks.

[darren_g]

It's a known bug in using application overrides - I ran into it recently myself.

Rather than use an application override, just create a custom port and allow that in your rule.

Something like this

In this rule, the service ports "unreal_tcp1" and "unreal_tcp2" refer to the two specific ports used by this application, and are defined as services objects. The rest of the rule simply locks down source and destination as required.

If you need other applications on the same server, then make a *separate* rule for them. You need to keep this rule on its own because you need to restrict the custom service ports (otherwise, other applications would be blocked because they didn't match the ports defined as "unreal_tcp1" and "unreal_tcp2").

cheers.