Stop vulnerability scanning based on app-id

illuzian — Fri, 07 Jul 2017 03:40:11 GMT

We have created a custom app id for internal only traffic that is currently generating false positives in our vulnerability scanning.

We ideally would like to stop this particular app-id from being scanned for vulnerabilites or at least a specific vulnerability. Unfortunately I've found no way to create an exception based on ID.

Application Override would suit us but from the documentation, I gather the signature of the app isn't processed and only the criterea specified in the override. We often seem to look at creating exceptions but the options for this at least appear to me to be too non-specific.

Can someone provide some insight?

Re: Stop vulnerability scanning based on app-id

acc6d0b3610eec313831f7900fdbd235 — Sat, 08 Jul 2017 18:21:11 GMT

Hi @illuzian@

After you create the custom app, and the application override policy, you can create a security policy.

In the security policy, you will specify the custom application you just created, but you will not apply any security profile. This will avoid the application from being scanned by the IPS engine. Remeber that you can be selective, and apply other profiles if you need too.

Since it is an internal application, and you seem to trust it, if performance is an issue, I would create this security policy with the DSRI feature in disabled state.

A session on the firewall comprises two flows, client to server and server to client. The DSRI feature on the Palo Alto Networks firewall can be enabled to skip the inspection of the Server to Client flow.

https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-Using-DSRI-with-the-Palo-Alto-Networks-firewall/ta-p/70666

I hope this helps.

topic Stop vulnerability scanning based on app-id in Advanced Threat Prevention Discussions

Stop vulnerability scanning based on app-id

Re: Stop vulnerability scanning based on app-id