topic Re: Enforce RFC compliance for the services protocol in Firewall and Security Management

Enforce RFC compliance for the services protocol

KostasGR — Wed, 21 Apr 2021 14:34:50 GMT

Hello

In order to Enforce RFC compliance for the services protocols (for example ftp,http,allow ssh v2 only and block ssh v1 ) do i need application control enabled or not?

BR
Kostas

Re: Enforce RFC compliance for the services protocol

G_W_Albrecht — Wed, 21 Apr 2021 14:47:05 GMT

I would say no - protocols are mostly analyzed by IPS Core protections. APCL enables you to differentiate between Apps, also ones that use the same protocols.

Re: Enforce RFC compliance for the services protocol

Bob_Zimmerman — Wed, 21 Apr 2021 15:13:15 GMT

Application Control is about letting you use "Facebook Games" and such in a rule. It's like URL Filtering.

Basic RFC compliance (like FTP verbs and HTTP verbs) is enforced by a feature called protocol inspection. That does not involve Application Control or any subscription, it's just built right into the firewall.

Deeper RFC compliance is more the domain of IPS. Still not Application Control, but a subscription feature commonly covered together.

Re: Enforce RFC compliance for the services protocol

Timothy_Hall — Wed, 21 Apr 2021 15:17:28 GMT

As Gunther said the IPS Core Protections enforce this, along with "Inspection Settings" located under Shared Policies. The IPS blade is not necessary unless you are using an R77.30 or older gateway, where Core Protections and Inspection Settings were originally part of the IPS Blade. In R80.10 and later they are part of the standard Access Policy (Firewall blade) as mentioned in my IPS Immersion video class.

Re: Enforce RFC compliance for the services protocol

KostasGR — Thu, 22 Apr 2021 15:30:50 GMT

Hello again

The below is from admin guide for security management r80.40.

Service Matching
The Security Gateway identifies (matches) a service according to IP protocol, TCP and UDP port number,
and protocol signature.
To make it possible for the Security Gateway to match services by protocol signature, you must enable
Application & URL Filtering on the Security Gateway and on the Ordered Layer.
You can configure TCP and UDP services to be matched by source port.

BR,
Kostas

Re: Enforce RFC compliance for the services protocol

Bob_Zimmerman — Thu, 22 Apr 2021 15:35:43 GMT

Protocol inspection is about enforcing some protocol compliance.

Protocol signatures are more about differentiating between multiple application-level protocols used over the same port.