Odd traffic going out through an application-specific security rule

[BSwientoniowski]

I've got a rule that allows the following applications from any source in our trusted zone out to any destination in the untrust zone.

• appdynamics
• dns-over-https
• dns-over-tls
• github
• ms-delve
• net.tcp
• ntp
• ocsp
• okta
• paloalto-updates
• paloalto-wildfire-cloud
• pan-db-cloud
• rtcp
• service-now
• skype
• ssh
• windows-azure
• windows-push-notifications

The rule is set for application-default.

We have some legitimate traffic on our network that goes from trust to untrust with the destination port of tcp/37.

For some reason, this traffic is matching up to this rule.  None of the applications in the rule list tcp/37 as a default port.  Only two of those applications (skype and net.tcp) have dynamic default ports.

When the tcp/37 traffic hits this rule, the application always shows up as "insufficient-data"

I know what the traffic is - it is supposed to be the old "TIME" protocol.  I've actually created a rule specific for this further down the list.

Any idea why the traffic would match up to this rule?

[BPry]

@BSwientoniowski,

Whenever you have a rule allowing application-default the firewall is going to allow enough traffic to identify the application. So the rule that this traffic is hitting is, if I would have to make an educated guess, the first entry in your security rulebase from trust to untrust that is based off of app-id. 

[BSwientoniowski]

Thanks for the response.  The rule that the traffic is hitting is actually the 4th rule in the list going from trust to untrust that is based off of app-id.

[OtakarKlier]

Hello,

Also as a suggestion, please use URL filtering as well as DNS sinkholes. Will make your security posture that much better.

Regards,