NGFW policy mode application default service

In NGFW policy-based mode, the application default service enforces applications running only on their default service port. The applications specified in the policy are monitored, and if traffic is detected from a nonstandard port, it is blocked, and a log entry is recorded with a port-violation event type.

If you are not using the default ports, and need to pick specific services, select Specify to select the required services.

Example

In this example, the standard port is enforced for HTTPS traffic using the HTTP.Audio application.

First, an SSL Inspection & Authentication policy is created do to traffic pre-match, and then a security policy is created to allow the HTTP.Audio application when using the default port. Fetching an MP3 file from an HTTP server using port 443 is allowed, but is blocked when using a nonstandard port, such as 8443.

To enforce the HTTP.Audio application using the default port in the GUI:

1. Create a new SSL Inspection & Authentication policy, or use the default policy.
2. Go to Policy & Objects > Security Policy, and click Create New.
3. Enter a name for the policy, such as allow_HTTP.Audio.
4. Configure the ports as needed.
5. Set Service to App Default.
6. In the Application field, select HTTP.Audio.
7. Set the Action to Accept.

   

8. Click OK.

To enforce the HTTP.Audio application using the default port in the CLI:

1. Create a firewall policy:

   config firewall consolidated policy
       edit 1
           set name "consolidated_all"
           set srcintf "port13"
           set dstintf "port14"
           set srcaddr4 "all"
           set dstaddr4 "all"
           set service "ALL"
           set ssl-ssh-profile "new-deep-inspection"
       next
   end

2. Create a security policy:

   config firewall security-policy
       edit 1
           set name "allow_HTTP.Audio"
           set srcintf "port13"
           set dstintf "port14"
           set srcaddr4 "all"
           set enforce-default-app-port enable
           set action accept
           set schedule "always"
           set logtraffic all
           set application 15879
       next
   end

Logs

The application logs show logs with an event type of port-violation for traffic on port 8443 that is blocked, and an event type of signature for traffic on port 443 that is allowed.

Blocked:

2: date=2019-06-18 time=16:15:40 logid="1060028736" type="utm" subtype="app-ctrl" eventtype="port-violation" level="warning" vd="vd1" eventtime=1560899740218875746 tz="-0700" appid=15879 srcip=10.1.100.22 dstip=172.16.200.216 srcport=52680 dstport=8443 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" proto=6 service="HTTPS" direction="incoming" policyid=1 sessionid=5041 appcat="Video/Audio" app="HTTP.Audio" action="block" hostname="172.16.200.216" incidentserialno=1906780850 url="/app_data/story.mp3" securityid=2 msg="Video/Audio: HTTP.Audio," apprisk="elevated"

Allowed:

1: date=2019-06-18 time=16:15:49 logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information" vd="vd1" eventtime=1560899749258579372 tz="-0700" appid=15879 srcip=10.1.100.22 dstip=172.16.200.216 srcport=54527 dstport=443 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" proto=6 service="HTTPS" direction="incoming" policyid=1 sessionid=5064 appcat="Video/Audio" app="HTTP.Audio" action="pass" hostname="172.16.200.216" incidentserialno=1139663486 url="/app_data/story.mp3" securityid=2 msg="Video/Audio: HTTP.Audio," apprisk="elevated"