unknown-tcp / udp - please explain

[cryptochrome]

Hi,

I know that these two applications stand for unrecognized traffic. It worries me though that for some of the other applications to work, I have to add unknown-tcp/udp to the firewall rule. Example for this would be Bittorrent traffic. To allow Bittorrent, I also have to allow web-browsing and unknown-tcp and unknown-udp.

Can someone please elaborate on this? If I only want to allow Bittorrent, but also add web-browsing and unknown-tcp, I will open up the firewall for unwanted traffic. I really have a hard time understand this concept.

Thanks

[cryptochrome]

Thanks. So if I understand correctly, the facebook-base "app" also knows the destination URLs for Facebook and dynamically opens them through the web-browsing dependency?

So I can be sure that opening facebook-app (and the implicit web-browsing dependency) will only allow traffic to Facebook.

More questions: What if Facebook adds new servers/URLs that are no yet implemented in AppID signatures? In that case I would have to revert to the PanOS 4.x way of doing things and add a custom URL category with those new URLs and put them in a rule like you explained above?

[jvalentine]

Thanks. So if I understand correctly, the facebook-base "app" also knows the destination URLs for Facebook and dynamically opens them through the web-browsing dependency?

So I can be sure that opening facebook-app (and the implicit web-browsing dependency) will only allow traffic to Facebook.

More questions: What if Facebook adds new servers/URLs that are no yet implemented in AppID signatures? In that case I would have to revert to the PanOS 4.x way of doing things and add a custom URL category with those new URLs and put them in a rule like you explained above?

You're welcome!  Yes, the facebook-base app-id signature knows how much/which URL(s) of web-browsing are required in order to enable the facebook-base app - so you won't be allowing other web-browsing traffic. 

"Back in the day" when I last did this with 4.1, I probably over-engineered (read: shotgunned) the custom URL category - but hey, it worked!  It could have worked with just *.facebook.com.  (Note to self, try this out in the lab sometime). 

IF Facebook changes the way their app works and IF it breaks the implicit dependency functionality, then yes, you could add an explicit dependency allow rule just for a custom URL category that has those new domains/URLs.  An explicit "allow web-browsing to FB-custom-category" rule will trump the implicit dependency functionality.  Not sure that this will ever happen, especially if it only needs *.facebook.com, but handy to have in your back pocket just in case. 

[cryptochrome]

Awesome. I think I got the hang of it now. No more worries for me now. Thanks!