Eval question

[derasa]

Given a flow and properly written policy to allow Facebook and its myriad apps/widgets on port 80/443, other than the admin management overhead (i.e., having to open ports 80 and 443), how is what Palo Alto does different from what Checkpoint does?

This question addresses the quote below (found on the link shown).

http://researchcenter.paloaltonetworks.com/2012/12/app-id-cache-pollution-response/

• Port 80 allow – open the floodgates. The always-on nature of port-based traffic classification, means old-guard firewalls will first need to open the application default port controlling the application. To control Facebook, you need to allow tcp/80 and tcp/443. Based on the June2012 Application Usage and Risk Report, you may be allowing more than 500 (42%) other applications that you may or may not want on the network. This means the strength of a default deny all policy is significantly weakened. If you are using Check Point, or any other port-based firewall, ask them if the above statement is true and how they recommend managing it.

In other words, if I allow ports 80/443 in my port policy and an application policy to allow Facebook apps only, I expect Checkpoint to be able to identify Facebook and non-Facebook traffic--then allow only the Facebook traffic and discard/block the rest.  I expect Palo Alto to do the same--with the exception that the admin would not incur the management overhead of dealing with explicitly opening ports.  Can someone elaborate on how Checkpoint (or any firewall that claims NG capabilities) opens "the floodgates."? 

Just looking for an objective/technical answer.

thanks

[hheck]

I'm an eval custom as well, so I don't have an extremely detailed answer. The way that Palo Alto works is that they inspect the packets and determine that they belong to Facebook, which then gets allowed in. Other firewalls will require you to open up port 80/443, which means you either need to limit that rule to all of Facebook's IPs, or allow those ports in general.