Skip to content

Paloalto generator does not support source_port #269

@abhindes

Description

@abhindes

Source_port is a supported token, but it is not implemented.

There is an existing PR for this, but has not been refactored, and I am unsure if this handling is our desired outcome for how source ports are handled - #238

Expected behavior -

  1. When a source_port (either individual port, or range) is supplied in a term, it should be added to the service entry for that term.
  2. If a source-port is unspecified, we should not be adding it by default to the service. As we've learned, source_port on PANOS is largely deprecated. This is also because we want to have the policy generated from Capirca match bit-by-bit what is obtained from the device. source_port should be added only when it is explicitly present in the term.
  3. If a destination_port is present, it should be added in the same service for that rule.

A snippet of what PANOS source-port looks like in the service entry (where destination_port was set to any, and source_port to range 1-65535) -

   <entry name="tcp">
      <protocol>
        <tcp>
          <port>any</port>
          <override>
            <no />
          </override>
          <source-port>1-65535</source-port>
        </tcp>
      </protocol>
    </entry>

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions