Paloalto generator should correctly support other protocols than TCP/UDP and ICMP/ICMPv6
- Dominant language
- Python
- Stars
- 857
- Forks
- 213
- PR merge metrics
- No merged PRs in 30d
Description
TCP, UDP, ICMP, ICMPv6 are supported correctly in the generator - TCP/UDP as services. ICMP/ICMPv6 as custom ip-protocol applications.
GRE and SCTP are currently implemented as in-built PANOS applications. This needs to be changed, since Capirca is vendor-neutral native L3/L4 filtering, and does not rely on ALG/App-ID (in PANOS) capabilities, since they are L7 based filtering.
The way to support GRE/SCTP (and other future protocols) is to create a custom ip-protocol application the way it is created for ICMP/ICMPv6.
When these protocols (say GRE) are present with TCP/UDP, it may be necessary to split them into separate rules to ensure correct translation of intent. One rule for TCP/UDP as services (which has application "any"), and another rule for the custom GRE ip-protocol application.
Contributor guide
Assessment
This issue has not been assessed yet.