I would like to create a custom App for SMTP submission. All I really want to do is restrict the "smtp" App to use 587/tcp only. It's usual "default ports" action is to allow 25/tcp or 587/tcp.
I just tried to create a Custom App based on "smtp," but have the only default port be "tcp/587." As I seemed to vaguely recall the other times I've tried to do this, without a signature section, the App does not match anything. SMTP traffic still matches "smtp," not my App.
Sure, I can create a whole new policy rule in the rule base with "smtp" as the application and a "submission" service on 587/tcp, but it would be a lot easier and more manageable to just drop a custom application into an existing application group.
Is there a way to create a custom App to change the default port behavior of a built-in App? (Note that this is not an Application Override thing. (Right?) I still want the PAN to do it's App ID voodoo, just change the default ports allowed.)
If you do not want to stop layer 7 processing then you can just create a security rule with SMTP allowed in it and specify the ports that you need in the service.
That way Palo Alto will detect SMTP based on layer 7 data but will only restrict the Application to be allowed when using the ports specified by you.
****Custom app without signature will work only if you override traffic on the expected port to your Customized APP.
I recently did something similar to this. Since the appliance will detect all applications regardless of the port they are running on you can make a custom service object. Instead of using Application Default with allows both 25 and 587, choose your custom service for just 587.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!