Ping and other Applications in the same rule on a non-standard port

[bafergel]

Is there a way to allow ping on a rule that has another application that uses a non-standard port? So for example, if yum uses port TCP 3142 instead of its default tcp/80,21 is there a way I can attach ping to that rule and still have it work? Like on Cisco ASAs you can add icmp as a port/service.

Example that doesn't work:

Example that does work:

[PavelK · Accepted solution]

Thank you for posting question @bafergel

Probably one way around it is to create a custom application by going to: Objects > Applications > Add, then under Configuration use new name, for example: "ping-tcp", then mimic all the setting under properties that ping is using as a default application. Under Advanced setting, configure new port:

Then replace existing ping application with this new application in your security policy.

Note: By default ping is using ICMP Type 0 and Type 8. If you want this to be working, you will also have to send ping from your client as TCP. Potentially 3rd party clients such as HPing or PsPing will have to be used instead of default ping utility in OS.

Kind Regards

Pavel

[OtakarKlier · Accepted solution]

Hello,

Remember that everything in the policy must match that policy. So if there is a defined port, e.g. 3142, ping would have to match that port for it to be allowed. In this case I would create a separate policy, cloned, and then add the applications you would like allowed and use the Application-Default setting instead of setting a specific port.

Regards,

[fkijamie]

This is generally bad practice.  Since ping is typically used for troubleshooting maintaining a separate rule can lead to inaccurate troubleshooting when the rules aren't identically maintained.