Vulnerability Protection profile alters APP-ID behavior

grenzi — Wed, 14 Dec 2022 10:42:54 GMT

Hello everybody,

while writing some articles on our company wiki, I found a strange behavior of the firewall. This is my environment:

PA model: PA-820

PAN-OS version: 10.1.8

APP/Threat version: 8653-7756

Decryption: SSL inbound enabled

I have a policy that allows access to the wiki with applications ssl and web-browsing. When no vulnerability protection profile is applied, I can access all pages of the wiki without any problem. The applications seen are, obviously, only ssl and web-browsing.

If I apply the provided strict vulnerability protection profile, accessing a particular wiki page is denied. The cause is that, when accessing that page, the application is identified as apache-guacamole instead of web-browsing. The wiki page is about installing and configuring Apache Guacamole, but it's not the Guacamole web UI. In the threat log there are no events about any threat detected. If I access the same page in edit mode, the page is not blocked.

These are the URLs involved:

https://my company domain/it/knowledge-base/guacamole/setup (this is blocked when the vulnerability protection profile is applied, app-id sees "apache-guacamole" application instead of web-browsing)
https://my company domain/e/it/knowledge-base/guacamole/setup (never blocked)

Any idea about the cause of this behavior? It seems to me that the vulnerability protection feature is confusing the APP-ID engine.

Re: Vulnerability Protection profile alters APP-ID behavior

BPry — Wed, 14 Dec 2022 17:44:01 GMT

@grenzi,

If you have an account team, I would pass this on to them and have them push it through internal channels. I don't know how well pushing something like this through TAC would actually work.

Re: Vulnerability Protection profile alters APP-ID behavior

grenzi — Fri, 10 Feb 2023 17:09:29 GMT

TAC says it's an expected behavior because, when applying security profiles, the Content-ID inspection looks at the content of the file/webpage and this can cause an application shift. The solution is to allow those applications on the security policy. This can make sense, but it's not very nice to allow an additional application where it's not actually in use.

topic Re: Vulnerability Protection profile alters APP-ID behavior in General Topics

Vulnerability Protection profile alters APP-ID behavior

Re: Vulnerability Protection profile alters APP-ID behavior

Re: Vulnerability Protection profile alters APP-ID behavior