Focus

PAN-OS Web Interface Help

Policies > Application Override

Table of Contents

Policies > Application Override

To change how the firewall classifies network traffic into applications, you can specify application override policies. For example, if you want to control one of your custom applications, an application override policy can be used to identify traffic for that application according to zone, source and destination address, port, and protocol. If you have network applications that are classified as “unknown,” you can create new application definitions for them (refer to Defining Applications).

If possible, avoid using application override policies because they prevent the firewall from using App-ID to identify applications and from performing layer 7 inspection for threats. To support internal proprietary applications, it’s better to create custom applications that include the application signature so the firewall performs layer 7 inspection and scans the application traffic for threats. If a commercial application doesn’t have an App-ID, submit a request for a new App-ID. If a public application definition (default ports or signature) changes so the firewall no longer identifies the application correctly, create a support ticket so Palo Alto Networks can update the definition. In the meantime, create a custom application so the firewall continues to perform layer 7 inspection of the traffic.

Like security policies, application override policies can be as general or specific as needed. The policy rules are compared against the traffic in sequence, so the more specific rules must precede the more general ones.

Because the App-ID engine in PAN-OS classifies traffic by identifying the application-specific content in network traffic, the custom application definition cannot simply use a port number to identify an application. The application definition must also include traffic (restricted by source zone, source IP address, destination zone, and destination IP address).

To create a custom application with application override:

Create a custom application (see Defining Applications). It is not required to specify signatures for the application if the application is used only for application override rules.
Define an application override policy that specifies when the custom application should be invoked. A policy typically includes the IP address of the server running the custom application and a restricted set of source IP addresses or a source zone.

Use the following tables to configure an application override rule.

Looking for more?

See Use Application Objects in Policy

Building Blocks in a Tunnel Inspection Policy

Application Override General Tab