MS-RDP and t.120 -> application: not-applicable

[ArnelManalo]

Hi,

I have a few rules that only permit ms-rdp and t.120. A new rule was implemented last week that permits ms-rdp and t.120, just different source addresses. The other rule can see the ms-rdp application but for the new rule, it shows up as application not-applicable and the traffic is being blocked.

I looked around here for some answers and have found that something before in the rule, the zone/source, etc. could be causing the tcp handshake not complete, thus not allowing the PA to pick up the application. However, the other rule which is working has the same zones set up, just the source address is different (same subnet). So I do not think it is anything to the left in the rule and the other rule is just above it so I do not think that is it either.

Just looking for some thoughts/ideas.

Thanks!

[jteetsel · Accepted solution]

Hello, the application will be listed as not-applicable if the traffic is being blocked via a rule that uses source\destination IP or zone as the criteria, with application "any". This happens because the traffic is blocked before it hits the content engine. The only time a block rule will show the application being blocked is when the application is the deciding factor on weather the traffic is blocked and is specifically listed in the application(s) for the policy.

Thanks

John

[ArnelManalo]

Hi John,

Thanks for the info. That would explain to me why it shows up as not-applicable when blocked. However, I suppose I am still curious as to why it is not seeing it as MS-RDP and being allowed through...

Thanks,

Arnel

[jteetsel]

I would take a look at the placement of the policy that's blocking the traffic...It could be that the policy blocking this traffic is sitting above the policy that allows it. If not, take a closer look at the policy that's supposed to allow it and find out why the traffic is not not hitting it.