Service port to application help

[ghostrider]

Hello Experts

We migrated Juniper netscreen firewall to PA. I am just struggling to make application based policies. User just send the ports to make security policies. Like:

1- Allow port tcp 1549 on mysql db

2- Allow https://ebs:8000

How I can handle this to put application only?

Kindly help me with best practice with PA

Regards,

GR

[nextgenhappines · Accepted solution]

Just create a policy with application and service as those specific port (application any, service tcp1549), run it for few hours|days|weeks and review the traffic log to check what application(s) are getting identify.   Once you are comfortable, create another rule with those application(s) identify and service port (for example, application mysql, service tcp 1549 {since mysql default port is tcp 3306}) and place the newly created specific application rule on the existing application any, service specific port rule.   Check again if the newly created rule missed any application and repeat the process until you are comfortable, and disable the service only rule.

[ghostrider]

You are the man ! So If I understand correctly, the "specific application - rule", I need to put above the "any application - rule" and see if "any application - rule" still getting hit? If not then I can delete this. Right?

[nextgenhappines · Accepted solution]

@ghostrider   That is correct.  Hope this helps..

[ghostrider]

thank you