Can custom appIDs, without signatures, be applied directly to a security policy?

rolinger — Wed, 21 Feb 2024 19:21:06 GMT

For this discussion, we created custom appID `myApp`, it has NO signature.

If `myApp` uses port 22, the port of another known app (SSH), then to use `myApp`, it must be applied to an App Override policy.

But what if `myApp` uses unique port 2121, can then `myApp` be applied directly to a security policy or does it still need to be added to an App Override policy?

We want to create simple appIDs, with no signature, to be applied to various security policies so we can A) ID the app in the policy without having to reference a service port and B) to be able to cleanly/clearly ID the traffic in traffic logs.

All the existing documentation I have found references creating custom appIDs using a port of a known app, but I can't find references to unique ports. As well, the documentation seems to imply that any apps applied to a security policy must have a signature while also implying custom apps without a signature must still use App Override policies. Its not very clear...IMO.

Thanks

topic Can custom appIDs, without signatures, be applied directly to a security policy? in Custom Signatures

Can custom appIDs, without signatures, be applied directly to a security policy?