>
    Cloud Managed
    Focus
    Download PDF
    Focus
    1. Home
    2. Network Security
    3. Network Security: Security Policy
    4. Policy Objects
    5. Policy Object: Applications
    6. Cloud Managed
    Download PDF
    Network Security

    Cloud Managed

    Table of Contents

    Cloud Managed

    Stateful layer 4 inspection for SIP-ALG and SMB traffic that overrides application-based policy.
    Palo Alto Networks determines what an application is irrespective of port, protocol, encryption, (SSH or SSL) or any other evasive tactic used by the application. Configure your won Application Override Policy to chance how traffic get classified to support internal or proprietary application.
    To change how your configuration classifies network traffic into applications, you can specify application override policies. For example, if you want to control one of your custom applications, an application override policy can be used to identify traffic for that application according to zone, source and destination address, and protocol. If you have network applications that are classified as “unknown,” you can create new application definitions for them
    Review your existing policy rulebase. If you have any Application Override rules for traffic other than SMB or SIP, convert the rule to an App-ID based rule so that you can decrypt and inspect the traffic at layer 7 and prevent threats.
    To create an application override:
    1. First go to
      Manage
      Configuration
      NGFW and Prisma Access
      Objects
      Applications
       and create a custom application. This is the application that you want traffic to match instead of the App-ID
      Prisma Access
       uses.
    2. Return to
      Manage
      Configuration
      NGFW and Prisma Access
      Network Policies
      Application Override
       to then create your application override security rule.
      This rule specifies when
      Prisma Access
       should invoke the custom application.
      Consider that when you create an application override security rule, you’re limiting
      Prisma Access
       App-ID from classifying traffic and performing threat inspection based on that application identification.
      To support internal proprietary applications, it’s worth thinking about creating a custom application (instead of an application override rule) that include the application signature so that
      Prisma Access
       performs layer 7 inspection and scans the application traffic for threats.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.