L7 Inspection

[NetworkGeek]

Hi All,

i migrated my asa to paloalto , but i can see that all policies are assigned service port but not appliation , so how can i get benefit from from application field ?

how can i transfer all polices from l4 to l7

[TranceforLife]

Hi,

You can specify application  based on your current ports and set in the service tab an "application-default" or "any" (less secure)  option/field:

[BPry]

@NetworkGeek to actually transfer the l4 to l7 you would need to do it more or less manually; there is no way to guarentee that a specified service actually means a given applicaiton, so those will not automatically switch over. 

[bradk14]

did you convert manually or via the migration utility? either way, the migration utility actually has a path to assist for migrating from port based to app based by importing logs back into it and analyzing the traffic and making suggestions that you can agree to or customize.

you should also be comfortable with the idea of application shift. traffic that starts out as web-proxy more often than not changes to another app, so just something to consider depending on your approach (whitelisting and implicit deny vs blacklisting and explicit allow).

I come from an ASA background and I can tell you while there are some basic similiarities, the two are worlds apart.

[BPry]

@bradk14 I always forget about the updated migration tool. I only used it a few times  years back and it kinda blew so I've just kinda ignored it. Even at "worlds apart" it might kind of be an understatement, the thought process of administering an ASA doesn't easily switch to the PAN world.