Clarification on Application and Service in security policy

[IBM-MSS]

Hi,

By restricting the security policy with specific application and allow ANY service leads to allow all traffic through that policy?

[BPry · Accepted solution]

@IBM-MSS,

Yes, and also not really ... but also yes ... but primarily no 😀

What happens in that situation is that the firewall needs to allow enough traffic to pass to actually identify the application, so your rule will capture a whole lot more traffic than your actual intent. That being said, as soon as the firewall can identify the application and it isn't what you have specified the traffic will no longer match the rule and continue to be analyzed according to the rest of your security rulebase.

I'd generally recommend being heavily cautious when you're creating these sort of policies, and make them as restrictive as reasonably possible. You are allowing traffic to pass to identify the actual application, there's no way around that when creating a policy like this. 

[IBM-MSS]

Thanks for the clarification.

During my investigation, i identified that telnet and netmap traffic is allowing through this policy. I believe this is because service will check on Layer 3 and Application will check on layer 7.

[Raido_Rattameister]

If you test connectivity with telnet then firewall sees TCP 3way handshake and as there is no application traffic yet it will be permitted.

You could set up some dummy rule to collect those incompletes and this avoids your app rule to match other traffic.

This example works well for that purpose as ping is not actually TCP application and it never matches to outgoing pings 🙂