google / google/capirca

Paloalto generator should correctly support other protocols than TCP/UDP and ICMP/ICMPv6

Open
#273 0 comments 0 reactions 0 assignees View on GitHub
generator: palo alto Priority-Low
Dominant language
Python
Stars
857
Forks
213
PR merge metrics
No merged PRs in 30d

Description

TCP, UDP, ICMP, ICMPv6 are supported correctly in the generator - TCP/UDP as services. ICMP/ICMPv6 as custom ip-protocol applications.
GRE and SCTP are currently implemented as in-built PANOS applications. This needs to be changed, since Capirca is vendor-neutral native L3/L4 filtering, and does not rely on ALG/App-ID (in PANOS) capabilities, since they are L7 based filtering.

The way to support GRE/SCTP (and other future protocols) is to create a custom ip-protocol application the way it is created for ICMP/ICMPv6.

When these protocols (say GRE) are present with TCP/UDP, it may be necessary to split them into separate rules to ensure correct translation of intent. One rule for TCP/UDP as services (which has application "any"), and another rule for the custom GRE ip-protocol application.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.