Settings for getting Hyper-V working in PAN

[lwilliams415]

setupHello,

I have been struggling with this all day, and I think I have it narrowed down, but can't seem to nail it down yet.

I have a test Hyper-V 2012 server in the data center, and all my services are working properly, except being able to connect to the VM's via Virtual Machine Connection. It uses TCP Port 2179 and is basically RDP, just running on this port instead of 3389. I have everything else working properly, but for some reason, when I either add a service with this port, it breaks MSRPC application, and if I add the tcp port to an application object, it still doesn't work. Looking at the logs and the pcaps, the firewall is doing what it is supposed to and dropping them, but it shouldn't be if I have the rules setup.

After spending 8 hours searching Google, Bing, Yahoo, Ask, and countless other search engines, including here, I have found not a single person or organization that is running Hyper-V behind a Palo Alto Firewall.

Any direction as to how to setup the Application or the Service to get this working would be great. Currently I have this server doing an allow all from both zones, so basically this server is not being protected by my firewall at all.

Any help would be greatly appreciated.

Thanks,

Lucas Williams

[lwilliams415 · Accepted solution]

I figured it out. I ended up moving away from the App-ID way and going with services. I just looked at the network flow and seen what ports were being called and created services for each port and then put them into a Service Group and applied it to my Hyper-V rule and now everything is working.

[ericgearhart]

Thanks for following up on this one, I'm sure it will help other folks who are in a Hyper-V environment

[lwilliams415]

Do be more specific what I did:

1. I created the following Services with these ports
   1. ms-rpc: tcp/135,49154
   2. ms-ds-smb-tcp: tcp/445,139
   3. ms-ds-smb-udp: udp/445
   4. hyper-v-rdp: tcp/2179
2. I then created a Service Group called Hyper-V-SVG and added those services to it.
3. I applied this service group to my Hyper-V server rule Allowing it and everything worked!