topic Re: Packet Flow Sequence and Application Override in Expedition Discussions

Packet Flow Sequence and Application Override

Michel.Thay — Fri, 11 Jan 2019 14:07:14 GMT

Hello everyone,

I have a question regarding the "AppID override" ,

In this article "https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0" we can read the following:

"
Special Note about Content and Threat inspection
Application Override to a custom application will force the firewall to bypass Content and Threat inspection for the traffic that is matching the override rule. The exception to this is when you override to a pre-defined application that supports threat inspection.
"

However, in the PaloAlto Packet Flow Sequence (available : http://live.paloaltonetworks.com//t5/image/serverpage/image-id/12862i950F549C7D4E6309) we can see this :

When the application override policy is matched the only step skiped is [Pattern-based application identification]. The "Content Inspection (SP3/CTD)" is allways performed, regardless of the application override. So the Content profiles seem to be applyed.

So my question is the following: is something missing from the diagram or am I wrongly reading the graph ?

Many thanks,
Karim BENYELLOUL

Re: Packet Flow Sequence and Application Override

Karim.Benyelloul — Sat, 12 Jan 2019 19:44:23 GMT

any update on this please ? 🙂

Re: Packet Flow Sequence and Application Override

bagherib — Sun, 13 Jan 2019 13:44:02 GMT

Interesting question. Have you tried testing this on a FW and looking into the logs?

Re: Packet Flow Sequence and Application Override

Karim.Benyelloul — Sun, 13 Jan 2019 14:09:52 GMT

Yes, it works as described in the article here "https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0" ... either I misunderstand something or the Packet flow is a bit missleading 😞

Re: Packet Flow Sequence and Application Override

alestevez — Mon, 14 Jan 2019 14:35:46 GMT

Hi, I will recommend close this threat here and re open it under the Firewall Community, This is for Expedition and it doesnt capture the attention of everybody 🙂