topic Re: Creating a Custom Application using a VLAN tag as the signature in Custom Signatures

Creating a Custom Application using a VLAN tag as the signature

Ivory.Desper — Mon, 06 Mar 2017 14:59:48 GMT

All,

I am trying to create a custom application that will be used for a rule instead of having to use standard ports. All traffic for this application is being tagged with a 802.1Q virtual Lan , PRI: 0, CFI 0, ID: XXX. I have tried creating a signature to trigger on this vlan ID with no success. Every signature type i use has not worked to this point. Has anyone ran into this problem and came up with a solution for this. Any help would be appriciated. Thanks.

Re: Creating a Custom Application using a VLAN tag as the signature

BenjAudy.MTL — Mon, 06 Mar 2017 21:12:50 GMT

Hi,

The VLAN tag is part of the Ethernet frame and is used for networking, so I doubt Palo Alto Networks will ever offer the ability to create a custom application signature based on it.

What is the original problem that made you want to have a custom app based on a VLAN tag?

Benjamin

Re: Creating a Custom Application using a VLAN tag as the signature

goku123 — Mon, 06 Mar 2017 21:19:14 GMT

As Baudy pointed out, the custom signature contexts are exposed to target mostly layer7 payload patterns.

VLAN tags at layer2 are not currently available to match a custom signature pattern against.

Re: Creating a Custom Application using a VLAN tag as the signature

Lucky — Tue, 07 Mar 2017 10:46:24 GMT

Hi, and welcome to our forums.

While other correctly pointed out this cannot be tagged as custom application; what you could do, in order to manipulate traffic from particular XXX vlan, is to create a .XXX sub-interface on the layer3 interface where trunked and tagged traffic is arriving, and add it to a separate new zone, than create traffic policies (whatever you need, blocking, allowing, alerting...) applied for that particular zone.

I believe my understanding is correct - you have trunk on some interface and some of the traffic is tagged, you wanted to manipulate it in a particular way (so you wanted to create a custom app) - this way, you will see all the traffic, and you can still create a custom app just based on the ports or the port ranges of the layer 4, without furhter complication.

Am I right and does this help? If not, can you try to explain what are you trying to achieve - perhaps we can solve it in a different way.

Best regards

Luciano