hey application and services in paloalto secyrity policy.. leaving for a second the application part Paloalto should be like all other layer 4 FW so first the policy will build a "layer 4" security policy based on source destenation and service and by this policy it will allow / block traffic. when you put in the applications part of the policy Paloalto should still build first a Layer 4 policy (that because application can only be recognized after certain amount of packets). so first Paloalto will see a ip packet and will look for an allow rule in the built "layer 4" policy if a match is found for allow the PA will allow traffic to pass until it be able to recognize the application. once the application is recognized the PA will check if the application is match on the rule, if it is not match it will look for other rulle that match both application and service port, if not found it will drop the traffic (this is why you may see traffic matched on not relevant rule) so here you get paloalto addition to the services cullomn which is the application defaults so you almost shouldn't care on what ports application are running, ACCEPT on allow rules: 1) the application usse ANY ports 2) your application does not use default ports if you put an allow rule with service any (or application defaults with application that use any service) remember that PA will first allow traffic based on the "Layer 4" policy so you will allow port scan to your resource untill the application is found. in a deny rule it is important to e the ANY in the service because you want to block the application no matter the port is running on
... View more
