Implicit Applications with cotp/ms-rdp in security policies





Hello everyone,

 

Been testing some PA firewall functionality and noticed that ms-rdp has the implicit use of "cotp" defined, but the cotp application matches to a rule further down the policy list. When I review the logs, it looks like this

 

![PAFWRDPCOTP.PNG](/t5/image/serverpage/image-id/21885iB7B90DC186DC1474/image-size/large?v=v2&px=999 "PAFWRDPCOTP.PNG")

Am I misunderstanding having cotp as implicitly allowed by the ms-rdp application? Not sure why ms-rdp is allowed as part of the Test-RDP rule but then cotp drops down to a policy further in the list.

 

I could add the cotp application to the Test-RDP rule, but shouldn't Test-RDP be where cotp is getting caught already?

 

Thanks!
Hi [@MathewRD](/t5/user/viewprofilepage/user-id/112936) .

 

when the tcp handshake is initiated for any application the firewall will view all policies for an explicit allow. If none are available then it will check again for any implicit allows.

 

i found these links helpful.

<https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLLICA4>

 

<https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV0CAK>

 




[View solution in original post](/t5/general-topics/implicit-applications-with-cotp-ms-rdp-in-security-policies/m-p/294040#M77643)
> 
> **$\underline{\textit{Application layer VPN's}}$**
> 
> 
> This type of VPN will work with specific applications. The most common example of this type of VPN network is seen over the SSL connections that people use to purchase items online every day. The Application layer VPN provides encrypted communication between the web browser that the visitor is using to view the item and the server that is used to process the order. There are other applications that can be protected in this way, as well. This type of VPN security requires that each different application be supported.
> 
> 
> **$\underline{\textit{Network layer VPN's}}$**
> 
> 
> A $\textit{Network layer}$ VPN functions on layer 3. Unlike Application layer VPN security, Network layer VPN security will encrypt any traffic, regardless of the different applications being used. This type of VPN is used by some of the most well-known names in Internet security. For example, Cisco uses this layer for VPNs. These VPN servers are sometimes provided under the names L2TP and GRE.
> 
> 
> **$\underline{\textit{Data Link VPN's}}$**
> 
> 
> **$\textit{Data Link VPN}$** is used when two private networks need to communicate. It is one of the most expensive types of VPN connection. Normally, the protocol used over these connections does not provide encryption, so encryption needs to be added to the connection.
> 
> 
> @ wrote:is there an option that i just haven't found that can be set for webroot to shut down the computer after a deep scan? do i need to enable the windows firewall? my router has a firewall that runs my computer in stealth mode.  hello ohheckyeah and welcome to the webroot community forums!  and to add yes you must have windows firewall on with wsa have a look here as to why: http://www.webroot.com/en\_us/secureanywhere/pc/wsa\_pc\_help.htm#c4\_firewall/ch4a\_managingfirewall.htm and it's a nice second layer to the router's firewall. cheers, daniel 😉 We currently have all our machines still on Windows XP and have only just upgraded some with Office 2007.


Budget dollars just have been too cost prohibitive to upgrade all 1,000 of our workstations. At some point due to licensing and availability we will be forced to upgrade. 


The one thing I’ve noticed difficulty with right off the bat has been the ability to connect via RDP to a Windows Server 2008 box. Without some registry hacks/mods in XP this can be problematic if the server is set to the newest (and more secure) RDP protocol. Windows 7 doesn’t have this issue. A couple of notes to get started:



> 
> .apply(literal\_eval)
> 
> 
> 


Wouldn't this be better as `map`?



> 
> I then re-create the Dask DF:
> 
> 
> ddf = dd.from\_pandas(ddf\_out, npartitions=nCores)
> 
> 
> 


`ddf_out` was already a dask dataframe, I don't know why you had to do this.



> 
> The columns in result seem to match those in metadir.
> 
> 
> 


The value of `result.columns` is taken from the meta you provided, no computing happens until you ask for it (dask is lazy in most operations). Does the ValueError exception not provide further information?


Here is a full example



```
x = ({'F9_07_PZ_COMP_DIRECT': '0',
  'F9_07_PZ_DIRTRSTKEY_NAME': 'DEBRA MEALY',
  'F9_07_PZ_COMP_OTHER': '0',
  'F9_07_PZ_COMP_RELATED': '0',
  'F9_07_PZ_TITLE': 'CHAIR PERSON',
  'F9_07_PZ_AVE_HOURS_WEEK': '1.00',
  'F9_07_PC_TRUSTEE_INDIVIDUAL': 'X'},
 {'F9_07_PZ_COMP_DIRECT': '0',
  'F9_07_PZ_DIRTRSTKEY_NAME': 'HELEN GORDON',
  'F9_07_PZ_COMP_OTHER': '0',
  'F9_07_PZ_COMP_RELATED': '0',
  'F9_07_PZ_TITLE': 'VICE CHAIR',
  'F9_07_PZ_AVE_HOURS_WEEK': '1.00',
  'F9_07_PC_TRUSTEE_INDIVIDUAL': 'X'})
df = pd.DataFrame({'a': x})
d = dd.from_pandas(df, 1)
meta = pd.DataFrame(columns=['F9_07_PZ_COMP_DIRECT', 
       'F9_07_PZ_DIRTRSTKEY_NAME',
       'F9_07_PZ_COMP_OTHER', 'F9_07_PZ_COMP_RELATED', 'F9_07_PZ_TITLE',
       'F9_07_PZ_AVE_HOURS_WEEK', 'F9_07_PC_TRUSTEE_INDIVIDUAL'], dtype="O")
d.map_partitions(lambda df: df.a.apply(pd.Series), meta=meta).compute()

```

How did I know what `meta` to use? I applied the function to the pandas dataframe - you might use a small piece of the dataframe to do this.


Some additional notes:


* it is an anti-pattern to load the data with pandas, pass to dask workers and then gather the whole result back to a pandas (in memory) dataframe, you are very unlikely to see a speedup this way and may incur a lot of overhead. You are better off loading with something like `dd.read_csv`, and aggregating or writing with dask functions too. Only `compute()` on something that will be small or not return anything (because it involves writing the output). The official examples do not use from\_pandas.
* string and dict processing are python methods, and so hold the interpreter lock (GIL) of any python function: threads will not actually run in parallel. To get parallelism, you need to run in processes, which is most easily achieved using <https://docs.dask.org/en/latest/setup/single-distributed.html>
* the distributed scheduler also gives you access to the dashboard, which has a lot of useful information to diagnose how your system is running. You can also configure a lot about its behaviour, in case you have firewall rules you need to obey. Magda, have you found what you need, yet?


I did this many years ago. It is simple… the 2nd time you do it!  

Exit points are simply “interrupts” that IBM supplies. You can attach programs to them, and the programs will automatically run at that point. For setting your AS/400 up to accept FTP logons, for example, the exit point is:  

QIBM\_QTMF\_SVR\_LOGON and the format you wil use is: TCPL0100.


A program inserted there can control WHO can log on, and when.  

To control WHAT they can do, you use another exit point, QIBM\_QTMF\_SERVER\_REQ and use format VLRQ0100.


My notes (from 1999) say I used the IBM TCP manual to get this info, specifically: TCP/IP manual SC41-5420-01 page I-14.


I do not know if it will allow me to post code here, it is long and complex due to the number of variables and some of them being in hex.


Write me (drow@waxie.com) if you would like me to email you my program code.


David Row  

WAXIE Sanitary Supply  

San Diego, CA





This is a link for [Add-ons for Firefox](https://addons.mozilla.org/en-US/firefox/). These are programs written by users or developers that the browser knows how and when to call. The developers of Firefox designed it to allow external programs to be hooked in by users of the browser.


IBM did something similar for a lot of the TCP/IP and other server functions. (And a lot of other things.) When you connect to the FTP server for example, the server checks to see if a program has been registered to process FTP logon requests. The registered program is an ‘exit program’.


Browser add-ons get an entry added to a file someplace within the browser directory structure. In your iSeries, the entry would be added to the Registration Facility. (Not always, but that’s the commonly recognized object for exit points and programs.) Use WRKREGINF to review your registration facility.


To create an exit program, you need to know the parameter list that will be passed to your program and the exit protocol. To find the parameter list, you should start looking at the documentation for the server the exit program will be associated with. The protocol, the meanings of the parms and what to with them, is also there.


A FTP exit program would be structured after documentation within the [File Transfer Protocol exit programs](http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rzaiq/rzaiqreferenceexit.htm) topic of the Information Center for your release.


Once registered, a server logon exit program (for example) would be called just before the server decides whether or not to accept the logon. Your exit program directly influences that decision by returning an ‘accept or reject’ parameter. It chooses based on examination of the input parms.


The exit program may control who can and cannot logon, where they may logon from, what times of day logons are accepted, or it might accept all logons — its purpose can be simply to write all logons to a log file or to send a message when particular logons happen. Your exit program can do whatever it is programmed to do at that point in the logon process.


It doesn’t have to be a ‘security’ function. It’s whatever you want it to be.


For the FTP server, there are two general exit points. One is just before a logon is accepted. The other is just before each transaction in a session is processed. You can control individual transactions just as you can logons. (FTP client has its own exit points.)


Most other exit programs work on similar principles.


A few issues complicate things.


* An exit program needs enough authority to do whatever it needs to do; it can’t always rely on the authority of the session user.
* An exit program shouldn’t unduly delay transactions; there’s no way to know how often an exit program may be called, so you don’t want it slowing down every single transaction.
* Exit programs may be called by many instances of a server at the same time; it shouldn’t be locking things that are needed by a different instance.
* IBM changes the interfaces at times and the servers themselves can get PTFs; regular, on-going maintenance can be needed — keep the programs direct with little complication.
* There are other issues, but those are enough to consider.


Code a very simple exit program that accepts the parms and returns an ‘Accept’ indication. Don’t have it do anything except maybe send a message to a message queue. That lets you see how the registration facility works and how the parms work. It also gives you a program that you can register and deregister in the future to check whether or not the server is stilling calling your program correctly. (Problems can happen.)


Tom mapping is the 3rd rail of cad software. most pd's cannot maintain gis files, etc. the best solution i've seen is what we have now. our system uses google maps (browser based) with a system layer over it. so, either it geo codes the address after the call is saved or it uses the lat/long we enter on the geo file in our system. we can also geo code officer alerts to the map. so much easier. we also have browser based maps from our gis analyst that has more parcel info but only dispatchers reference it. best bet is to add a layer over the google map with your boundaries. i actually spoke to my vendor and they are going to add a boundary layer to our stuff as well. it's a good idea. just a note to say this is resolved.one thing i'd not realised was that a policy doesn't take effect until 'save...to firebox' is selected. (smh)anyway, the original engineer got back in contact and reckons that the original policy that should have been handling the traffic (the one in the screenshots above) had too many destination choices in it, such that the firebox got confused and couldn't find the match, then moved on to the rest of the policies until it got to the end (block-all).he reckons this is an issue with the version of the os our firewall is running but is fixed in the new version.what's handling the traffic now is a new policy that accepts smtp traffic on port 25 from our server to any-external address.thanks all for your responses. wow.

good idea with the packages. i have compared it with another system. the package “opennms-plugin-protocol-radius” is missing here. (we use radius login)

i installed it and opennms works now.

but in the meantime i have deactivated 5 adapters. i’ll take that back one by one. let’s see what hap… loopback basically applies user policy as a computer policy.
merge vs replace is how the policy gets applied.
merge mode
in this mode, when the user logs on, the user's list of gpos is typically gathered by using the getgpolist function. the getgpolist function is then called again by using the computer's location in active directory. the list of gpos for the computer is then added to the end of the gpos for the user. this causes the computer's gpos to have higher precedence than the user's gpos. in this example, the list of gpos for the computer is added to the user's list.
replace mode
in this mode, the user's list of gpos is not gathered. only the list of gpos based on the computer object is used. **I DID IT!!**

After long readings in English and French I finally understood that I had to disable the "SIP" in the rescue Terminal in order to access the COLORSYNC file that was blocked (System file)

Then I was able to remove the "recommended" file.  
Then I re-installed Photoshop and it worked!

I am so proud of my determination! Nobody on the phone or chat ever thought about that option. I wish it could help other people 🙂  
Have a nice day everyone and thaks for your advice.