Security Policy is passing the service which is not configured in policy.

[MPESDC]

We have created a VPN to Trust rule for just FTP and SSH Service for server in which we have Allowed only those services with application any. But the some of the traffic is passing with the some random service port with the same rule with application ftp which is not mention in security policy. Any Idea why is this happening.

[Remo]

Hi @MPESDC 

This is a special case for the application ftp. In an initial ftp connection the actual data transfer port is sent in the payload of the controlconnection. The firewall reads this and opens the additional port dynamically. This is at least the explanation for this behaviour so far.

I see it here probably as you do. If you have specified exactly one port, the firewall should not allow dynamically another one - even if this breaks the ftp connection. In this situation I recommend to open a TAC case for either finaly clarification or informing them about this behaviour.

[nikoolayy1]

You may check this article and your app configuration and you can you use app overide to not only to allow passive FTP but lso to block it:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFeCAK

[OtakarKlier]

Hello,

As a best practice, I would recommend you use the Application rather than the port.

Regards,