Rule to block TOR Application blocks all traffic directed to Internet

[Jacopo_Vigano]

Hello Community,

we have an issue when we try to block TOR application. We do a rule like the image reported below and put it on top of the rulebase:

 

But it seems that all Internet traffic is dropped by the rule named "Tor_Blocking".

 We see the Application is "Not-Applicable" on all log files. It seems PaloAlto cannot resolve properly the Applications involved.

At the moment we are not using SSL Decryption and we have PANOS 7.0.6 and Application Version 584-3342 on a cluster of PA-5060 appliances.

Do you have any idea to resolve this issue?

Let me know if you need any other information.

Thanks in advance.

Jacopo

[jambulo]

Im not sure why you're seeing this behavior. We have a similar rule and it works fine. Only difference is we have it set to App-Default for Service. Which should be fine because its "Standard Ports" are TCP/dynamic. You should give that a try.

[Jacopo_Vigano]

Hi @jambulo,

I'll ask customer to set application default as "service" and i'll update you.

What version of PANOS are you using?

Thanks.

Jacopo.

[reaper]

I'd also recommend changing the source zone from 'any' to 'trust' and instead of setting the negate for rfc-1918, to simply set the destination netwrok to 'any' (as there should not be any rfc-1918 ip addresses upstream and your ISP should drop these anyway)

[Jacopo_Vigano]

Hi All,

customer will try to change the rule in the next few days. I'll update you as soon as possible.

Thanks,

Jacopo.

[santonic]

Can you confirm that you have for example port 80 open somewhere in policy and that TOR rule blocks traffinc on that port anyway?

Even if it works with service set to application-default (which is all ports anyway in this case) I still think something is broken here and PA should be notified.