working process behind policy with multiple depended applications

[SandeepChinta]

I was little ambigous on how Palo alto processes a policy. let say i have a policy with 3 applications(a,b,c) in application field and multiple service ports(1,2,3) is there a chance that one of the application(a or b or c) specified in my application field is also being allowed on ports other than what it meant be allowed (say A must be allowed on port 1,but it is also communicating via 2 or 3).    

[rmfalconer · Accepted solution]

If you have 3 apps and 3 ports, then any of the apps can match any of the listed services.

App A could be communicating on port 1, 2 or 3. Same for app B and app C.

When grouping multiple items in a policy element, it's an OR statement. The traffic must match application A OR B OR C and it must match service 1 OR 2 OR 3. So A + 3 or B +1 are both valid matches.

If you need to restrict App A to a single port, you'll need to use a unique security policy rule.

[reaper · Accepted solution]

@rmfalconers statement is correct regarding the 'OR' property of any object added to the same field in a secureity policy (app A or B or C)

but

if you enable 'application-default' in the services, instead of using singular service objects, all applications used in security policy will only be matched against their own default ports (visible in the application properties) while other apps will not be allowed to re-use those ports unless they are listed in their own properties

as an example look at rule A and B below. they are identical except for the services:

Rule B will allow facebook, ssl and web-browsing on tcp 22 and ssh on tcp 80 and 443

Rule A will allow ssh on tcp 22, but not tcp 80 or 443, web browsing (cleartext http) on tcp 80 but not 443 or 22, ssl on port 443, but not 22 or 80

so you will not need to create a single rule per application, you only need to use application-default to prevent applications re-using other applications' ports