Deny rules with service application-default

[batd2]

It is not clearly described in documentation and I could not find a complete topic related to it. How does application:any, service:application-default behaves when apply to a “Deny” rule?

Presumably it will block the application if application is detected on a default port, but normally deny rules do not have recognised application, because of not enough packets to detect the application. How will application be detected?

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

• Incomplete
• Insufficient-data
• unknown,
• apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
• apps with port not defined (e.g. icmp)

[BPry · Accepted solution]

@batd2,

So as soon as the application is identified and the rule is matched, the firewall will take the deny action depending on the type of traffic you are blocking (reset/drop). Essentially, this rule will work exactly as you would expect it too without any issue. 

Also how will “application-default” rule behave (regarding if deny or allow) in the following cases of a traffic with AppID:

• Incomplete
• Insufficient-data
• unknown,
• apps with ports “tcp/dynamic” or “udp/dynamic” (e.g. torrent)
• apps with port not defined (e.g. icmp)

Because the application needs to be identified, the first three bullets in this list don't match anything. As for the last two bullet points, the rule works as you would expect; once the application is identified the deny action is performed by the firewall and the traffic is reset or dropped. 

[batd2]

@BPry Thank you for your quick response. That makes sense appart from "this rule will work exactly as you would expect it "

I did some more testing and looks like that traffic with unidentified AppID is just being allowed and logged as matching this rule, even though the rule has action "Deny". 

So is it right to say that all unidentified AppID traffic will just be let in? 

[BPry]

@batd2,

SO that's actually expected behavior. Just like in an allow rule with an app-id specified, the firewall needs to allow enough traffic to pass to actually go through the app-id process. Once the app is properly categorized, the traffic will go through the identification process again and it will match the proper security entry.