11-22-2019 06:08 AM
We have security policy to allow any application on port 3389.
I see users are able to connect to server on port 3389.
traffic log shows denied on application cotp.
my understanding is that if you have application as any it should cover all the applications.
why it is getting denied on app cotp for port 3389?
Running PAN os 8.1.9
11-24-2019 11:21 AM
I agree that this does not make sense, as long as the source really hits your RDP rule. Another idea I do not have right now.
Did you do a security policy match test on the cli (or in WebUI if you already are on PAN-OS 9) with exactly the same connection details as the dropped connections? And does it then match your RDP rule?
11-24-2019 11:35 AM - edited 11-24-2019 11:37 AM
here is test from cli
i am running pan os 8.1.9
(active)> test security-policy-match from CorpData_INT to Pay_Prod_DMZ application ms-rdp source 10.63.44.68 destination 10.29.33.34 protocol 6 destination-port 3389
(active)> test security-policy-match from CorpData_INT to Pay_Prod_DMZ application cotp source 10.63.44.68 destination 10.29.33.34 protocol 6 destination-port 3389
i see no output
05-06-2020 04:34 PM
Did you end up resolving this ?
PANOS 8.1.12 App content 8264-6059 installed.
Was working last week.
Now I log into a client site and instead of ms-rdp , my traffic is blocked cotp as the app-id. Confirmed its TCP traffic.
I prefer not to just add cotp to my security policy, since that doesn't really fix the problem just works around it and adds something I'm not condoning at this point.
05-06-2020 05:18 PM
So it wasn't any content change, in the end or anything, it was due to someone removing my access to the destination via RDP in the past week with user-id restrictions on the destination.
This resulted in the policy-deny to take place, but still, the odd thing is the App-id recognised ONLY in the deny messages is cotp.
Once I corrected the group membership and my user-id was allowed in, the app-id was recognised as ms-rdp correctly.
Hope this helps someone else. Maybe something to correct from a firewall traffic log standpoint, this would have streamlined troubleshooting if the traffic was blocked and the app-id read ms-rdp as expected.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!