Service Port overwrites Application default provided port (?)

[Martin2K]

Hello,

I would like to get a better understanding about the relationship Service vs Application when setting up FW rules:

Example:

"mysql" is provided with service TCP port 3306. 

If a rule is created using service TCP Port 58740 and in same rule under application "mysql" is added, would it cause the PA to associate application "mysql" with port 58740 system-wide. In other words, it would have a global effect on all rules using "mysql".

I would appreciate, if someone could shed some light on it.

Thanks,

[Martin2K]

Let me rephrase my question.

If you add "mysql" is application, which by default is associated with port 3306.

And in same rule you would add server TCP 58740.

Where would Palo look first - at Layer 7 - "mysql" or Layer 4 TCP Port 58740.

Would it break the association with port 3306. And Palo would only allow traffic on TCP Port 58740 and not application "MySQL". In other words, it would break the rule for allowing traffic for Application "MySQL"?

[Martin2K]

Security rules are evaluated left to right and from top to bottom.

Source Address | User | Device | Zone |

Destination Address | Device Application | Service | Action | Profile Options Target

https://docs.paloaltonetworks.com/network-security/security-policy/administration/security-rules#

Based on this statement, is PA checking Application first, and if it matches for example "mysql", [default 3306],  PA would not  look further into the entry [TCP port 58740] added in Services? column?