Exposing Videoconference - "Incomplete" traffic allowed

Reply
Highlighted
L4 Transporter

Exposing Videoconference - "Incomplete" traffic allowed

Hi all

I have tried to expose Videoconference system behind Palo Alto.
Unfortunately using App ID in security policy I have seen Palo Alto allows a lot of "incomplete" traffic.

That's really an issue: When enabling h.323 in security Policy App id engine starts to allows every port in order to find something related to this protocol and obviously you will see in the traffic log incomplete as" session end-reason".

Which is the best practice in this kind of situation?

Thanks in ⎌advance
D!Z

Accepted Solutions
Highlighted
Cyber Elite

Re: Exposing Video conference - "Incomplete" traffic allowed

You can apply zone protection on whatever zone you wish, and really you should have one for your DMZ and your OUTSIDE zones if you have both. Depending on how you have things setup would indicate what zone your traffic shows, but you can verify this in your traffic log by (addr in publicip) and seeing what your destination zone is for traffic going to that address. 

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: Exposing Video conference - "Incomplete" traffic allowed

Do you have one public ip or range?

Do you SNAT traffic out from same IP that videoconference system from internet connects to you?

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

Re: Exposing Video conference - "Incomplete" traffic allowed

I have configured static-ip source mapping with bidirectional option flagged! And I have only one public IP!
Highlighted
Cyber Elite

Re: Exposing Video conference - "Incomplete" traffic allowed

@TheRealDiz,

Can you share more details on how you are actually doing the NAT. H.323 shouldn't be allow every port by any means as H.323. Is this a Polycom unit that you are having troubles with? 

Highlighted
L4 Transporter

Re: Exposing Video conference - "Incomplete" traffic allowed

Nope!

 

That's the issue 

 

H.245 is a control channel protocol used with[in] H.323 communication sessions, and involves the line transmission of non-telephone signals.
Category:
collaboration
Subcategory:
voip-video
Technology:
client-server
Risk:
3
Standard Ports:
tcp/dynamic

 

How can I proceed with this protocol?! Should I Enable everything?!

 

Anybody has this issue before?

 

Thx

Luca

Highlighted
L4 Transporter

Re: Exposing Video conference - "Incomplete" traffic allowed

I think the only way to proceede is to define a port range with who has configured the Videoconference system and put that range in the NAT bidirectional rule.

 

Do you agree?

 

D!ZZZ

Highlighted
L7 Applicator

Re: Exposing Video conference - "Incomplete" traffic allowed

Well tcp/dynamid does not mean that you permit application traffic on all ports.

You permit TCP 3way handshake on any port but if traffic that follows does not match application that is permitted then session is dropped by Palo.

Bad thing is that if you permit all tcp ports in then attackers can do port scan from outside.

Good example is that you never permit application SMTP and port ANY towards your email server because this will permit anyone outside to scan all ports on your mail server to identify what services are running.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

Re: Exposing Video conference - "Incomplete" traffic allowed

Exactly

I'm worried about "port scan" because PA in order to identify an Application, allow the first packets to the server (SYN, SACK).

So I've seen from traffic a lot of attempt from outside to Videoconference server, allowed by Palo Alto:

 

Incomplete allowed.JPG

 

NOTE** As you can see the reset is coming from server and packet is allowed

 

 

D!ZZ

Highlighted
L4 Transporter

Re: Exposing Video conference - "Incomplete" traffic allowed

Obviously that's a Palo Alto's default behavior .. But when you got an application such as h.245 that has defined as standard port "tcp/dynamic" .. You'll got an issue, because PA's starts to allow first packet (SYN, SACK) in order to identify h.245 application (A LOT OF PACKETS coming in)!

 

That's not great... :(

 

Highlighted
L7 Applicator

Re: Exposing Video conference - "Incomplete" traffic allowed

Well there is not much that Palo can do - application is designed that way.

 

If you have video conference only with limited peers you can add their public IP into rule where you permit this traffic in from.

Or create External Dynamic List that pulls Video conference peer IP's from intranet site.

When people in company plan Video conference they just update intranet site and add peer to the list.

No firewall side reconfiguration needed.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!