Actions Supported on Applications
You can perform any of the following actions on this page:
Actions Supported for Applications
Filter by application
Add a new application.
View and/or customize application details.
Click the application name link, to view the application description including the standard port and characteristics of the application, risk among other details. For details on the application settings, see Defining Applications.
If the icon to the left of the application name has a yellow pencil ( ), the application is a custom application.
Disable an applications
Disablean application (or several applications) so that the application signature is not matched against traffic. Security rules defined to block, allow, or enforce a matching application are not applied to the application traffic when the app is disabled. You might choose to disable an application that is included with a new content release version because policy enforcement for the application might change when the application is uniquely identified. For example, an application that is identified as web-browsing traffic is allowed by the firewall prior to a new content version installation; after installing the content update, the uniquely identified application no longer matches the Security rule that allows web-browsing traffic. In this case, you could choose to disable the application so that traffic matched to the application signature continues to be classified as web-browsing traffic and is allowed.
Enable an application
Select a disabled application and
Enableit so that the firewall can manage the application according to your configured security policies.
Import an application
To import an application, click
Import. Browse to select the file, and select the target virtual system from the
Export an application
To export an application, select this option for the application and click
Export. Follow the prompts to save the file.
Export an application configuration table
Assess policy impact after installing a new content release.
Review Policiesto assess the policy-based enforcement for applications before and after installing a content release version. Use the Policy Review dialog to review policy impact for new applications included in a downloaded content release version. The Policy Review dialog allows you to add or remove a pending application (an application that is downloaded with a content release version but is not installed on the firewall) to or from an existing Security policy rule; policy changes for pending applications do not take effect until the corresponding content release version is installed. You can also access the Policy Review dialog when downloading and installing content release versions on the
Tag an application.
A predefined tag named
sanctionedis available for you to tag SaaS applications. While a SaaS application is an application that is identified as
Saas=yesin the details on application characteristics, you can use the sanctioned tag on any application.
Tag applications as
sanctionedto help differentiate sanctioned SaaS application traffic from unsanctioned SaaS application traffic, for example, when you examine the SaaS Application Usage Report or when you evaluate the applications on your network.
Select an application, click
Tag Application, and, from the drop-down, select the predefined
Sanctionedtag to identify any application that you want to explicitly allow on your network. When you then generate the SaaS Application Usage Report (see Monitor > PDF Reports > SaaS Application Usage), you can compare statistics on the application that you have sanctioned versus unsanctioned SaaS applications that are being used on your network.
When you tag an application as sanctioned, the following restrictions apply:
You can also
Override tag. The override option is only available on a firewall that has inherited settings from a device group pushed from Panorama.