05-26-2016 11:41 AM
For instance, web browsing on port 8080. I don't want to just set the service as I also want to use port 80 and there are other apps in the rule and I'd like to use app-default as the service.
I defined a custom app with web-browsing as the parent and the port as tcp/8080. That worked until I upgraded to 7.1.2 and then it broke. I'm aware that 7.1 changed the behavior when the App = Any and the Svc = App-Default, but for my custom app, brilliantly named "web-browsing_8080", the default port is 8080, so why it no work?
BTW, in my mind this could be as simple as cloning the default web-browsing app and changing the port number but for unknown reasons that isn't allowed.
-- Thank you
05-27-2016 01:12 AM - edited 05-27-2016 01:14 AM
Hi Dave
Is this proxy traffic or regular web-browsing on http ?
If it's proxy sessions (web-browsing directed at a proxy server), there's an app for that! Add http-proxy to your policy and you're good to go
If it's regular web-browsing on a different port, create a custom application with the desired attributes and set the parent app to web-browsing
05-27-2016 05:23 AM
Yeah, that's what I did and it worked until I updated to 7.1.
Adding a little more info the rule has an app group and that app group includes both web-browsing and my custom app (web-browsing_8080) and the service was set to app-default. That worked until the upgrade at which point I had to change the service to ANY as a quick fix.
05-30-2016 02:13 AM
in 7.1 the default behavior of 'application-default' has changed : PAN-OS 7.1 Policy behavior change application-default
so that it now enforces default ports for 'implied' applications (so 'any' app with app-default will allow all apps but only on their default ports)
did you make sure to define tcp/8080 as the default port for your custom application ?
you may wanna reach out to support to make sure there isn't an issue with this deployment
06-02-2016 10:52 AM
In the custom app definition under the Advanced tab it's set to port and tcp/8080. If there's another place to define the port I don't know about it.
I've opened a support ticket, then promptly took some time off so haven't talked to them yet. Hopefully tomorrow.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
