topic Re: Abnormality in pattern matching of APP CONTRL BLADE in General Topics

Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 12:23:28 GMT

Hi Checkmates,

I have a security policy created for communication between a pair of device, I'm using a custom created TCP high port (TCP 30K+) in service and no applications are mentioned inside the rule. But when I'm checking the logs it is matched against an APP named net.TCP.

Can someone shed light on how this is happening, how is traffic matched against an APP which I never specified in the rule.

Thanks in advance!

======

WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

G_W_Albrecht — Tue, 18 Feb 2025 12:40:49 GMT

This is TCP 8080, not TCP high port (TCP 30K+) in service ! And 8080 is used by:

Protocol	Port number	Service Name and Comment	Usage
Endpoint Security
TCP	8080	not predefined	Loopback port (used by EPM process). Endpoint Security Management Server and Directory Scanner -> Apache Tomcat HTTP on Endpoint Security Management Server.
Threat Emulation
TCP	8080	not predefined	HTTP - FakeServer listens for packets coming from the VM during WebEmulation. SSL Proxy.
Mobile Access
TCP	8080	HTTP_and_HTTPS_proxy	Front-end daemon of Mobile Access (used by multi-processes - mpdaemon)

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 13:12:55 GMT

Technically, what Guenther sent is right, its from below:

https://support.checkpoint.com/results/sk/sk52421

High ports would start from 49152 and this port is way below that.

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 13:14:37 GMT

@G_W_Albrecht Thanks for your reply!

Actually I'm trying to make a different point, I'm not using the 8080 service inside the policy but somehow it is matching against an APP that uses 8080.

The service that I'm using in my policy is TCP 32000.

Hope you got my point!
========

WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 13:27:32 GMT

@the_rock ,

When I create a policy to allow TCP 320000, why would the inspection module match it against an APP that uses 8080. Please help me on this.

====
WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 13:27:46 GMT

Can you try something like below?

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 13:29:13 GMT

See the screenshot I attached in my last response, not sure if thats how you have it configured currently.

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 13:33:47 GMT

@the_rock , Yes you are right !

That is how the port is configured.

Can you tell me what is wrong in this?

========

WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

G_W_Albrecht — Tue, 18 Feb 2025 13:35:44 GMT

I see no screenshots e.g. from rule base and logs that show your point !

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 13:36:24 GMT

If you can send us the screenshot of the rule/logs, would help, for sure.

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 13:53:37 GMT

@the_rock I'm sorry that I can't give you my prod rule/logs.

I have replicated the same for your reference, PFA .

======

WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 13:55:22 GMT

Thats fair, no problem! Can we see what that tcp_30k looks like?

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 14:01:21 GMT

Can we do a remote ? @the_rock

======
WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 14:03:37 GMT

I think everyone saw my messages about remote, haha. Thats okay, Im always happy to do my best to help. Not sure what time zone you are in, but Im in Canada EST, so its 9 am here, so I can do during my lunch, so say at 12 pm est, in 3 hours.

If that works, let me know and I can send you zoom link few mins before then.

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

G_W_Albrecht — Tue, 18 Feb 2025 14:21:25 GMT

How is the service itself defined ? You only show us a service group, not a service definition like:

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 14:31:08 GMT

@G_W_Albrecht

PFA.

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 15:01:25 GMT

That looks right to me. Anyway, if you are still good for remote, just let me know, so I can arrange.

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 15:05:55 GMT

Let's do it , can you please let me know the exact timing so that I can be ready for it.

========

WR,

Re: Abnormality in pattern matching of APP CONTRL BLADE

the_rock — Tue, 18 Feb 2025 15:08:19 GMT

Will send you zoom in direct message 5 mins before, so at 11.55 am EST (or 4.55 pm GMT), so 2 hours from now.

Andy

Re: Abnormality in pattern matching of APP CONTRL BLADE

Firewall_Head — Tue, 18 Feb 2025 15:22:51 GMT

OK 👍