Deny rules with service application-default

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L2 Linker

Deny rules with service application-default

It is not clearly described in documentation and I could not find a complete topic related to it. How does application:any, service:application-default behaves when apply to a “Deny” rule?

 

Presumably it will block the application if application is detected on a default port, but normally deny rules do not have recognised application, because of not enough packets to detect the application. How will application be detected?

 

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

  • Incomplete
  • Insufficient-data
  • unknown,
  • apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
  • apps with port not defined (e.g. icmp)

Accepted Solutions
Highlighted
Cyber Elite

@batd2,

So as soon as the application is identified and the rule is matched, the firewall will take the deny action depending on the type of traffic you are blocking (reset/drop). Essentially, this rule will work exactly as you would expect it too without any issue. 

 

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

  • Incomplete
  • Insufficient-data
  • unknown,
  • apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
  • apps with port not defined (e.g. icmp)

Because the application needs to be identified, the first three bullets in this list don't match anything. As for the last two bullet points, the rule works as you would expect; once the application is identified the deny action is performed by the firewall and the traffic is reset or dropped. 

View solution in original post


All Replies
Highlighted
Cyber Elite

@batd2,

So as soon as the application is identified and the rule is matched, the firewall will take the deny action depending on the type of traffic you are blocking (reset/drop). Essentially, this rule will work exactly as you would expect it too without any issue. 

 

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

  • Incomplete
  • Insufficient-data
  • unknown,
  • apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
  • apps with port not defined (e.g. icmp)

Because the application needs to be identified, the first three bullets in this list don't match anything. As for the last two bullet points, the rule works as you would expect; once the application is identified the deny action is performed by the firewall and the traffic is reset or dropped. 

View solution in original post

Highlighted
L2 Linker

@BPry Thank you for your quick response. That makes sense appart from "this rule will work exactly as you would expect it "

I did some more testing and looks like that traffic with unidentified AppID is just being allowed and logged as matching this rule, even though the rule has action "Deny". 

So is it right to say that all unidentified AppID traffic will just be let in? 

Highlighted
Cyber Elite

@batd2,

SO that's actually expected behavior. Just like in an allow rule with an app-id specified, the firewall needs to allow enough traffic to pass to actually go through the app-id process. Once the app is properly categorized, the traffic will go through the identification process again and it will match the proper security entry. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!