Content translations are temporarily unavailable due to site maintenance. We apologize for any inconvenience. Visit our blog to learn more.
06-14-2018 06:29 PM
Hello, I have two questions.
1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ?
2. when i configure service any What is difference policy action deny & drop?
Best regards.
06-15-2018 12:25 AM
Hi @hbshin
@hbshin wrote:1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ?
PaloAlto identifies these applications based on the headers in the datapackets. Because UDP is stateless (not something like TCP handshake) in most cases there already enough informations in the first packet for App-ID.
@hbshin wrote:2. when i configure service any What is difference policy action deny & drop?
Each application has a default deny-action specified which is taken when you set the action to deny (some apps have reset-client, some have reset-both, ...). If you set rhe action to drop, then this default deny-action will be ignored and the connection will be silently dropped.
06-15-2018 12:25 AM
Hi @hbshin
@hbshin wrote:1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ?
PaloAlto identifies these applications based on the headers in the datapackets. Because UDP is stateless (not something like TCP handshake) in most cases there already enough informations in the first packet for App-ID.
@hbshin wrote:2. when i configure service any What is difference policy action deny & drop?
Each application has a default deny-action specified which is taken when you set the action to deny (some apps have reset-client, some have reset-both, ...). If you set rhe action to drop, then this default deny-action will be ignored and the connection will be silently dropped.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
