topic Re: How to automate rules with App-ID in Automation/API Discussions

How to automate rules with App-ID

MicahGawin — Tue, 30 Jul 2019 20:27:48 GMT

How can you automate firewall rule creation when App-ID is used? This seems easy enough on a port-based firewall, but I have yet to see anything addressing APP-ID. A typcial flow could look like this:

user submits firewall request form

appropriate approvals submitted

automation handles the form

automation provisions the firewall based on the approved user request

How are people handling the automation/form submittal process when App-ID is used? The APP-ID webpage provides information as to what applications are available but does not seem to fit the use case listed above.

Hope you are having a great day!

Re: How to automate rules with App-ID

drogers — Tue, 30 Jul 2019 21:32:59 GMT

One of the workflows I've seen allows users to select AppIDs on the FW CR form. Depending on your user base you could limit the AppID list to a curated selection, or do something fancy like filter based on which port the user selects. You can pull the AppID DB from the firewalls/Panorama using the API, and the Application Default ports are listed for each AppID, so the data could come from there.

Re: How to automate rules with App-ID

MicahGawin — Tue, 30 Jul 2019 21:54:20 GMT

Thanks! I was trying to parse the data from the App-ID website, I didnt realize I could use the local API.

Re: How to automate rules with App-ID

rhagen — Tue, 30 Jul 2019 22:05:07 GMT

I like the curated selection approach that @drogers mentions because it will silmplify the request process and require less rework when the wrong application is selected. Giving an end-user a choice of 3,000+ App-ID signatures would be asking for trouble.