12-14-2022 02:42 AM
Hello everybody,
while writing some articles on our company wiki, I found a strange behavior of the firewall. This is my environment:
PA model: PA-820
PAN-OS version: 10.1.8
APP/Threat version: 8653-7756
Decryption: SSL inbound enabled
I have a policy that allows access to the wiki with applications ssl and web-browsing. When no vulnerability protection profile is applied, I can access all pages of the wiki without any problem. The applications seen are, obviously, only ssl and web-browsing.
If I apply the provided strict vulnerability protection profile, accessing a particular wiki page is denied. The cause is that, when accessing that page, the application is identified as apache-guacamole instead of web-browsing. The wiki page is about installing and configuring Apache Guacamole, but it's not the Guacamole web UI. In the threat log there are no events about any threat detected. If I access the same page in edit mode, the page is not blocked.
These are the URLs involved:
Any idea about the cause of this behavior? It seems to me that the vulnerability protection feature is confusing the APP-ID engine.
12-14-2022 09:44 AM
If you have an account team, I would pass this on to them and have them push it through internal channels. I don't know how well pushing something like this through TAC would actually work.
02-10-2023 09:09 AM
TAC says it's an expected behavior because, when applying security profiles, the Content-ID inspection looks at the content of the file/webpage and this can cause an application shift. The solution is to allow those applications on the security policy. This can make sense, but it's not very nice to allow an additional application where it's not actually in use.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
