-
Notifications
You must be signed in to change notification settings - Fork 210
Closed
Description
Source_port is a supported token, but it is not implemented.
There is an existing PR for this, but has not been refactored, and I am unsure if this handling is our desired outcome for how source ports are handled - #238
Expected behavior -
- When a source_port (either individual port, or range) is supplied in a term, it should be added to the service entry for that term.
- If a source-port is unspecified, we should not be adding it by default to the service. As we've learned, source_port on PANOS is largely deprecated. This is also because we want to have the policy generated from Capirca match bit-by-bit what is obtained from the device. source_port should be added only when it is explicitly present in the term.
- If a destination_port is present, it should be added in the same service for that rule.
A snippet of what PANOS source-port looks like in the service entry (where destination_port was set to any, and source_port to range 1-65535) -
<entry name="tcp">
<protocol>
<tcp>
<port>any</port>
<override>
<no />
</override>
<source-port>1-65535</source-port>
</tcp>
</protocol>
</entry>