My SMTP rule allows a lot of other traffic

[ldormond]

Hello,

I have a specific rule that only allows SMTP application.

When looking at the traffic logs related to this rule, I see a huge amount of other packets !

Most of them are "incomplete", but I also have a lots of applications like dns, oracle, RPC and unknown-tcp.

I heard that setting service to "application-default" could resolve thus kind of issue, but as my PaloAlto SE said "You don't have to care about port and services anymore, this next-gen fireall is based on application...."

I see...

Laurent

[mharding]

The incompletes I wouldn't worry about. That means the session did not complete the three-way handshake.

I still define the service (port) for all my policies. I would either set the port for app-default or port 25.

[ldormond]

Indeed, when setting service to "application-default" it's much  better. No more heterogenous traffic. The only other traffic I get is  "incomplete".

Thanks for your help.

However I don't really understand why application signature was not sufficient in this case...

Regards,

Laurent

[licenselu]

Hello Laurent,

Before being classified as SMTP traffic, TCP Three handshake must be completed (if not you see 'incomplete' in the logs).

Then, after few packets exchange, the PA is able to assign 'SMTP' protocol to the traffic flow.

If you do not use 'application-default or custom service, all traffic (on any port) match that rule...

Regards,

Hedi

[DavePalo]

When allowing traffic by application (SMTP in this case), a certain amount of traffic must be 'seen' by the Palo in order for it to determine whether the traffic is indeed SMTP.

You will receive an entry in the log against this rule for every packet destined to your SMTP server IP address regardless of whether it is SMTP or not.

Only those evaluated and determined to be SMTP will be allowed through.

As others have suggested, these can be greatly reduced if you set port as application-default - if that suits your intended use.