Next-Generation Firewall
Application Level Gateways
Table of Contents
Application Level Gateways
App-ID identifies apps by their unique properties; for dynamic-port applications, the
NGFW acts as an ALG, creating temporary pinholes and performing NAT payload rewrites as
needed.
App-ID identifies applications by their unique properties rather than just ports
| Where Can I Use This? | What Do I Need? |
|---|---|
|
This is a core Network Security feature for NGFWs and Prisma
Access; no prerequisites needed.
|
The Palo Alto Networks firewall does not classify traffic
by port and protocol; instead it identifies the application based
on its unique properties and transaction characteristics using the
App-ID technology. Some applications, however, require the firewall
to dynamically open pinholes to establish the connection,
determine the parameters for the session and negotiate the ports
that will be used for the transfer of data; these applications use the
application-layer payload to communicate the dynamic TCP or UDP
ports on which the application opens data connections. For such
applications, the firewall serves as an Application Level Gateway
(ALG), and it opens a pinhole for a limited time and for exclusively
transferring data or control traffic. The firewall also performs
a NAT rewrite of the payload when necessary.
- H.323 (H.225 and H.248) ALG is not supported in gatekeeper routed mode.
- When the firewall serves as an ALG for the Session Initiation Protocol (SIP), by default it performs NAT on the payload and opens dynamic pinholes for media ports. In some cases, depending on the SIP applications in use in your environment, the SIP endpoints have NAT intelligence embedded in their clients. In such cases, you might need to disable the SIP ALG functionality to prevent the firewall from modifying the signaling sessions. When SIP ALG is disabled, if App-ID determines that a session is SIP, the payload is not translated and dynamic pinholes are not opened. See Disable the SIP Application-level Gateway (ALG).
When you use Dynamic IP and Port (DIPP) NAT, the Palo Alto
Networks firewall ALG decoder needs a combination of IP and Port
(Sent-by Address and Sent-by Port) under SIP headers (Contact and
Via fields) to be able to translate the mentioned headers and open
predict sessions based on them.
The following table lists IPv4, NAT, IPv6, NPTv6 and NAT64 ALGs
and indicates with a check mark whether the ALG supports each protocol
(such as SIP).
App-ID | IPv4 | NAT | IPv6 | NPTv6 | NAT64 |
|---|---|---|---|---|---|
SIP | 
|
|
| — | — |
SCCP |
|
|
| — | — |
MGCP |
|
| — | — | — |
FTP |
|
|
|
| — |
RTSP |
|
|
|
| — |
MySQL |
|
| — | — | — |
Oracle/SQLNet/ TNS |
|
|
|
| — |
RPC |
|
| — | — | — |
RSH |
|
| — | — | — |
UNIStim |
|
| — | — | — |
H.225 |
|
| — | — | — |
H.248 |
|
| — | — | — |