You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
TCP, UDP, ICMP, ICMPv6 are supported correctly in the generator - TCP/UDP as services. ICMP/ICMPv6 as custom ip-protocol applications.
GRE and SCTP are currently implemented as in-built PANOS applications. This needs to be changed, since Capirca is vendor-neutral native L3/L4 filtering, and does not rely on ALG/App-ID (in PANOS) capabilities, since they are L7 based filtering.
The way to support GRE/SCTP (and other future protocols) is to create a custom ip-protocol application the way it is created for ICMP/ICMPv6.
When these protocols (say GRE) are present with TCP/UDP, it may be necessary to split them into separate rules to ensure correct translation of intent. One rule for TCP/UDP as services (which has application "any"), and another rule for the custom GRE ip-protocol application.
The text was updated successfully, but these errors were encountered:
TCP, UDP, ICMP, ICMPv6 are supported correctly in the generator - TCP/UDP as services. ICMP/ICMPv6 as custom ip-protocol applications.
GRE and SCTP are currently implemented as in-built PANOS applications. This needs to be changed, since Capirca is vendor-neutral native L3/L4 filtering, and does not rely on ALG/App-ID (in PANOS) capabilities, since they are L7 based filtering.
The way to support GRE/SCTP (and other future protocols) is to create a custom ip-protocol application the way it is created for ICMP/ICMPv6.
When these protocols (say GRE) are present with TCP/UDP, it may be necessary to split them into separate rules to ensure correct translation of intent. One rule for TCP/UDP as services (which has application "any"), and another rule for the custom GRE ip-protocol application.
The text was updated successfully, but these errors were encountered: