topic Re: appl/urlf AWS S3 not recognized in Firewall and Security Management

appl/urlf AWS S3 not recognized

abihsot__ — Mon, 17 Feb 2020 16:25:59 GMT

Hi there,

R80.30 JHF111 with inspection enabled. I build the policy with only AWS S3 application allowed. Everything else is dropped.

In the logs I see that when connection goes to s3.amazonaws.com, it is recognized correctly, but when connection goes to s3.eu-central-1.amazonaws.com for example, it is now no longer S3 app, but generic computers/internet category.

Re: appl/urlf AWS S3 not recognized

PhoneBoy — Thu, 20 Feb 2020 21:48:48 GMT

What is your precise rule for allowing this?
Screenshot?

Re: appl/urlf AWS S3 not recognized

abihsot__ — Mon, 24 Feb 2020 09:26:04 GMT

Hi,

the rule is very simple:

source: server, destination:internet, services&app - amazon S3. Next rule - drop any.

As a workaround I added custom app with urls I mentioned in previous post which are not automatically recognized as Amazon S3, however I am interested what attributes second link is missing that prevents tagging it as AWS S3 app. I would guess that checkpoint is not making decision about app only by url.

s3.amazonaws.com

s3.eu-central-1.amazonaws.com

Re: appl/urlf AWS S3 not recognized

PhoneBoy — Tue, 25 Feb 2020 00:34:49 GMT

I suspect some of the AWS regions might not be recognized properly by the App Control signature.
Might be worth a TAC case.