Service Port overwrites Application default provided port (?)

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Service Port overwrites Application default provided port (?)

L1 Bithead

Hello,

I would like to get a better understanding about the relationship Service vs Application when setting up FW rules:

Example:

"mysql" is provided with service TCP port 3306. 

If a rule is created using service TCP Port 58740 and in same rule under application "mysql" is added, would it cause the PA to associate application "mysql" with port 58740 system-wide. In other words, it would have a global effect on all rules using "mysql".

I would appreciate, if someone could shed some light on it.

 

Thanks,

 

2 REPLIES 2

L1 Bithead

Let me rephrase my question.

If you add "mysql" is application, which by default is associated with port 3306.

And in same rule you would add server TCP 58740.

Where would Palo look first - at Layer 7 - "mysql" or Layer 4 TCP Port 58740.

Would it break the association with port 3306. And Palo would only allow traffic on TCP Port 58740 and not application "MySQL". In other words, it would break the rule for allowing traffic for Application "MySQL"?

Security rules are evaluated left to right and from top to bottom.

Source Address | User | Device | Zone |

Destination Address | Device Application | Service | Action | Profile Options Target

 

 

https://docs.paloaltonetworks.com/network-security/security-policy/administration/security-rules#

Based on this statement, is PA checking Application first, and if it matches for example "mysql", [default 3306],  PA would not  look further into the entry [TCP port 58740] added in Services? column?

  • 260 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!