We have in-house software that uses secure-telnet port 992 and that has been blocked after the 7.1.4-h2 upgrade. I've created a rule to pass the traffic to the destenation address with any application any service but never help, the logs said reset both by internzone rule, only changing interzone rule to allow will let the application communicate. Even I did appliaction override on the SSL with destinationa port and address not helped me at all.
Please any clue how to fix this?
Thanks. So your traffic is denied by default policy cause it does not match any other policy. Can you show me a policy config pls for this particular session? What was your policy before an upgrade? Did you try to create a rule with SSL app and destination port 992. I understand you have tried any any but l had strange behaviour, similar to yours. So when l created rule to be more specific it worked for me.
Ok. So from what l understood you have a policy inside >outside with application "any" and the service "application-default".
So PAN-OS 7.1 changes the behaviour for the policy with application-default specified. See below:
Your policy will allow any APPs but only on the default ports. From the logs, we can see that you have SSL as an application but 992 as a port. Default inter-zone has any any that is why it is permitting your traffic.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!