Hello Andy, Let me clarify for you. If you enable Application FASP in your security policy, then it will explicitly allow the underlying dependent application SSH. But, that does not mean, the source IP's (users) will be able to access SSH application ( i.e putty, remoteNG etc) . Only if the traffic is coming in conjunction with the parent application FASP, then only the firewall will allow the traffic through it. NOTE: With PAN-OS 5.0.0 software and above, we can now allow an application in security policy without the need to explicitly allow the underlying protocol dependency (for most protocols) . This is supported only if the application can be identified within a pre-determined point in the session. Applications that qualify for this PAN-OS feature will have this support enabled in the Content version starting onwards 323. I did a test on my LAB: Security RULE-1 Source IP- 1.1.1.1 destination IP-2.2.2.2 Application FASP Action -Allow Security RULE-2 Source IP- 1.1.1.1 destination IP-2.2.2.2 Application ANY Action -Deny While trying to access IP 2.2.2.2 through SSH ( putty) from IP 1.1.1.1, it's falling under RULE-2 and traffic is getting denied by the PAN firewall. Hope this helps. Thanks
... View more
.png "Satish"){kind=avatar}
