Wrong categorization of traffic to icmp,tracert and communication break for web traffic

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Wrong categorization of traffic to icmp,tracert and communication break for web traffic

L3 Networker

Hi team,

 

We facing issue with PA firewall that, traffic from browser or application categorized to ICMP related and match to ping enabled rule in mass.
Due to this, return traffic of the TCP session drops and application communication interrupts intermittently.

Suhairul_Salleh_0-1727407293953.png

 

 

Based on our findings, the rule "Rule ID 26" which applications are set with "icmp, ping and traceroute" only in that rule.
Hence, it should not suppose to be seen as 443 by right.
Need your advice why 443 is seen under Rule ID 26 in traffic log, please?

 

<entry name="Rule ID 26" uuid="b57d11eb-2f12-4042-a58f-57e2351c062e">
<profile-setting>
<group>
<member>SecProfile_Outbound</member>
</group>
</profile-setting>
<from>
<member>DMZ</member>
</from>
<to>
<member>Untrust</member>
</to>
<source>
<member>any</member>
</source>
<destination>
<member>any</member>
</destination>
<source-user>
<member>any</member>
</source-user>
<category>
<member>any</member>
</category>
<application>
<member>icmp</member>
<member>ping</member>
<member>traceroute</member>
</application>
<service>
<member>any</member>
</service>
<action>allow</action>

 


Appreciate your clarification.

1 REPLY 1

L3 Networker

Change the service from any to Application default in the rule id 26. That's the reason the incomplete application For port 443 is matching with that policy. Still it will allow all the icmp based applications mentioned in the rule.

Edsnow

Please help out other users and “Accept as Solution” if a post helps solve your problem !
  • 340 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!