Dynamic TCP port APP query

[ash83]

Hi community, In a situation where there is a security policy allowing: SOURCE Source IP: any Source Zone: outside DESTINATION Destination IP: public IP 1.2.3.4 -> NAT'd to private IP 10.10.10.10 (servername1) (the security policy is using the post NAT zone). The inbound NAT is also correctly configured, and NATing correctly. APP: appX -> any APP which uses tcp/dynamic ACTION allow The service provided by servername1 has to be available to the world, and it is serving APP=appX content (using dynamic tcp ports) The above scenario will efectively allow any IP to access 1.2.3.4 -> 10.10.10.10 (servername1) using APP=appX on ANY tcp port. Restricting the source IPs to some IPs, or country, continent etc is not an option, as it is a service that needs to be available to anyone on the internet. Is it not using appX -> any APP which uses tcp/dynamic a huge security risk, as a it is allowing connection on any tcp port, and this will end up taking down 10.10.10.10 (servername1) after it cannot handle any more connections? The only solution I can think off is to stop using appX in the above scenario, and try to use service (L4 instead) - which is not really a Palo Alto friendly approach. Any idea(s) would be much appreciated. Thanks.

[Remo]

Hi @ash83

In the security policy you could specify a service in addition to the app. This way you can restrict the detection of the app to the port(s) you specify.

[ash83]

Hi vsys_remo,

What could be done if the app in use in enhanced-file-transfer?

Thanks.

[Remo]

---

@ash83 wrote:

What could be done if the app in use in enhanced-file-transfer?

---

Sorry, this one I don't understand. What do you want to do?