About Inelse

Inelse · ‎04-07-2021

Thanks Nikolay. It looks like we would have to leave the two rules active as they are. I've checked the applications that are detected by the service port rule and there are just too many. This rule is for general user web traffic so can't be too restrictive.

Inelse · ‎04-07-2021

Thanks Nikolay and Sutare for your responses. Both rules are identical with the exception that one is using App-ID, the other Services. Nikolay, your theory makes sense and looks like this is what's actually happening. So if we disable the service based rule, does this mean that most of the tcp/443 traffic will be blocked? Is there a way to allow any web traffic using App ID without having to specify all possible apps (eg. google, youtube, etc)? Thanks!

Inelse · ‎04-06-2021

Hi All, I'm new to Palo so hope you guys can help me understand something. We have two almost identical security policies that allow traffic via ports tcp/443 and 80. The first policy uses App IDs, ssl and web-browsing. The second policy uses services tcp/443, 80. My expectation is that the second policy should never be hit since ports 443 and 80 are allowed by the first policy, but this is not the case. Both policies receive a lot of hits on port 443. My question is, why is the first policy bypassed for tcp/443 traffic? Thanks!

Member Since	‎04-06-2021 01:08 AM
Date Last Visited	‎04-10-2021 02:30 PM
Posts	3
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎04-10-2021 02:30 PM

About Inelse

Re: Policy, using App ID ssl, is bypassed in favor of service based policy

Re: Policy, using App ID ssl, is bypassed in favor of service based policy

Policy, using App ID ssl, is bypassed in favor of service based policy

Re: Policy, using App ID ssl, is bypassed in favor of service based policy

Re: Policy, using App ID ssl, is bypassed in favor of service based policy

Re: Policy, using App ID ssl, is bypassed in favor of service based policy

Policy, using App ID ssl, is bypassed in favor of service based policy