Discuss about a question in ACE

[ThongPD]

Hi,

I got a question from ACE and answered in there. But the answer was incorrect.

I don't know why. Anyone can explain this question. So please!

Thanks,

Thong.

[ThongPD]

Hello,

Anybody help me.

Thanks.

[HULK]

Hello ThongPD,

As per my understanding, the answer will be

1. Bittorrent traffic will be allowed.

2. SSH traffic will be denied by the device.

Explanation:

1. The Palo Alto App-ID feature will identify the application after a few transactions ( after TCP 3 way handshake, it will observe few packets to identify the application based on App-ID signature) , hence SSH and bittorrent traffic will never hit the first security rule.

2. Once the application will be identified as "Bittorrent", the sevice "any" will allow that traffic on any non-standard port.

3. After identifying the application SSH, the service "application-default" will not allow SSH application apart from the default port 22. Hence SSH on port 3333 will be dropped by the firewall.

Hope this helps.

Thanks

[VinceM]

Hi,

No reason for ssh connexion not matching the last rule ... and to be allowed.

As ssh not running on normal port, it will not match the 2nd rule (for me service is part of trigger to know if traffic match the rule or not).

V.

[HULK]

Hello ThongPD,

Apologize for the confusion. I have tested this into my LAB and the result agrees with what Vince' comments. SSH should be allowed through the last rule.

Thanks