I have two questions. about UDP Application & policy action

Reply
Highlighted
L2 Linker

I have two questions. about UDP Application & policy action

Hello, I have two questions.

 

1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ?

 

2. when i configure service any What is difference policy action deny & drop?

 

Best regards.


Accepted Solutions
Highlighted
L7 Applicator

Re: I have two questions. about UDP Application & policy action

Hi @hbshin

 


@hbshin wrote:

1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ?


PaloAlto identifies these applications based on the headers in the datapackets. Because UDP is stateless (not something like TCP handshake) in most cases there already enough informations in the first packet for App-ID.

 


@hbshin wrote:

2. when i configure service any What is difference policy action deny & drop?


Each application has a default deny-action specified which is taken when you set the action to deny (some apps have reset-client, some have reset-both, ...). If you set rhe action to drop, then this default deny-action will be ignored and the connection will be silently dropped.

 

 

 

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: I have two questions. about UDP Application & policy action

Hi @hbshin

 


@hbshin wrote:

1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ?


PaloAlto identifies these applications based on the headers in the datapackets. Because UDP is stateless (not something like TCP handshake) in most cases there already enough informations in the first packet for App-ID.

 


@hbshin wrote:

2. when i configure service any What is difference policy action deny & drop?


Each application has a default deny-action specified which is taken when you set the action to deny (some apps have reset-client, some have reset-both, ...). If you set rhe action to drop, then this default deny-action will be ignored and the connection will be silently dropped.

 

 

 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!