Palo Alto Networks provides weekly application updates
to identify new App-ID signatures. By default, App-ID is always
enabled on the firewall, and you don't need to enable a series of
signatures to identify well-known applications. Typically, the only
applications that are classified as unknown traffic—tcp, udp or
non-syn-tcp—in the ACC and the traffic logs are commercially available
applications that have not yet been added to App-ID, internal or
custom applications on your network, or potential threats.
On occasion, the firewall may report an application as unknown
for the following reasons:
Incomplete data—A handshake took place, but no data packets
were sent prior to the timeout.
Insufficient data—A handshake took place followed by one
or more data packets; however, not enough data packets were exchanged
to identify the application.
The following choices are available to handle unknown applications:
Create security policies to control unknown applications
by unknown TCP, unknown UDP or by a combination of source zone,
destination zone, and IP addresses.
Request an App-ID from Palo Alto Networks—If you would like
to inspect and control the applications that traverse your network,
for any unknown traffic, you can record a packet capture. If the
packet capture reveals that the application is a commercial application,
you can submit this packet capture to Palo Alto Networks for App-ID
development. If it is an internal application, you can create a
custom App-ID and/or define an application override policy.
Create a Custom Application with
a signature and attach it to a security policy, or create a custom
application and define an application override policy—A custom application
allows you to customize the definition of the internal application—its
characteristics, category and sub-category, risk, port, timeout—and
exercise granular policy control in order to minimize the range
of unidentified traffic on your network. Creating a custom application
also allows you to correctly identify the application in the
traffic logs and is useful in auditing/reporting on the applications
on your network. For a custom application you can specify a signature
and a pattern that uniquely identifies the application and attach
it to a security policy that allows or denies the application.
if you would like the firewall to process the custom application using
fast path (Layer-4 inspection instead of using App-ID for Layer-7
inspection), you can reference the custom application in an application
override policy rule. An application override with a custom application
will prevent the session from being processed by the App-ID engine,
which is a Layer-7 inspection. Instead it forces the firewall to
handle the session as a regular stateful inspection firewall at
Layer-4, and thereby saves application processing time.
example, if you build a custom application that triggers on a host
, the packets are first identified
and then are matched as your custom
application (whose parent application is web-browsing). Because
the parent application is web-browsing, the custom application is
inspected at Layer-7 and scanned for content and vulnerabilities.
you define an application override, the firewall stops processing
at Layer-4. The custom application name is assigned to the session
to help identify it in the logs, and the traffic is not scanned