Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Paloalto generator does not support source_port #269

Closed
abhindes opened this issue May 12, 2021 · 2 comments
Closed

Paloalto generator does not support source_port #269

abhindes opened this issue May 12, 2021 · 2 comments

Comments

@abhindes
Copy link
Collaborator

abhindes commented May 12, 2021

Source_port is a supported token, but it is not implemented.

There is an existing PR for this, but has not been refactored, and I am unsure if this handling is our desired outcome for how source ports are handled - #238

Expected behavior -

  1. When a source_port (either individual port, or range) is supplied in a term, it should be added to the service entry for that term.
  2. If a source-port is unspecified, we should not be adding it by default to the service. As we've learned, source_port on PANOS is largely deprecated. This is also because we want to have the policy generated from Capirca match bit-by-bit what is obtained from the device. source_port should be added only when it is explicitly present in the term.
  3. If a destination_port is present, it should be added in the same service for that rule.

A snippet of what PANOS source-port looks like in the service entry (where destination_port was set to any, and source_port to range 1-65535) -

   <entry name="tcp">
      <protocol>
        <tcp>
          <port>any</port>
          <override>
            <no />
          </override>
          <source-port>1-65535</source-port>
        </tcp>
      </protocol>
    </entry>
@kevinsteves
Copy link
Contributor

Enhancement in #275

@abhindes
Copy link
Collaborator Author

abhindes commented Jun 9, 2021

This issue is closed, since #275 is merged.

@abhindes abhindes closed this as completed Jun 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants