topic Re: Why does the service tunnel_test_mapped disable Accept Templates? in Firewall and Security Management

Why does the service tunnel_test_mapped disable Accept Templates?

kamilazat — Fri, 02 Aug 2024 14:47:21 GMT

Hi all!

While playing with rules and services to understand more about templating, I noticed that when the tunnel_test_mapped service is included in a rule, Accept Templates get disabled.

I could only find sk44075 talking about this service, and apparently it needs to be used when "Accept control connections" is disabled in Global Properties.

Does anyone know what this service exactly is (the vague explanation and protocol no.17 (UDP) does not help) and what it does?

And what is the difference between enabling "Accept control connections" in Global Properties and creating a rule with tunnel_test_mapped service?

Thank you in advance!

Re: Why does the service tunnel_test_mapped disable Accept Templates?

the_rock — Fri, 02 Aug 2024 15:02:58 GMT

Very good question! I googled it, but best you can find is whats in service properties, nbot much on support site either.

Andy

Re: Why does the service tunnel_test_mapped disable Accept Templates?

Alex- — Fri, 02 Aug 2024 15:41:43 GMT

It's explained in sk32578 which describes SecureXL, in the section describing the conditions which prevent an acceleration template from being created.

Rules with "complex" services - services that have anything specified in the "Match" field, or "Enable reply from any port" , or "Source port" of their "Advanced" section.

Re: Why does the service tunnel_test_mapped disable Accept Templates?

the_rock — Fri, 02 Aug 2024 16:33:17 GMT

That is true. It would be nice to know though what exactly that service does.

Andy

Re: Why does the service tunnel_test_mapped disable Accept Templates?

PhoneBoy — Fri, 02 Aug 2024 18:30:58 GMT

It appears to be related to checking VPN Security Associations according to a TAC note I saw.

Any service with a handler in it will disable Accept Templates as per SecureXL limitations.
This doesn't happen when enabled in Global Properties as it's not

Re: Why does the service tunnel_test_mapped disable Accept Templates?

kamilazat — Mon, 05 Aug 2024 05:57:27 GMT

Hello Alex. Thank you for the response. It somehow makes sense.

But now I have another question. What is the difference between enabling "Accept control connections" in Global Properties and creating a rule with tunnel_test_mapped service, considering I'm not making any changes to the properties of the service (as in "Use default settings" enabled)?