topic Re: Is New App ID Rule Setup Correctly? in General Topics

Is New App ID Rule Setup Correctly?

DuggiFresh — Tue, 28 Mar 2023 22:40:30 GMT

Its getting a lot of hits, I setup Application filter for new app IDs and added them to their own Security Policy rule. Does this look correctly? Im confused as to why its getting so many hits.

Re: Is New App ID Rule Setup Correctly?

DuggiFresh — Thu, 30 Mar 2023 15:31:13 GMT

Any Ideas as to why it would have so many hits on this rule? All the traffic hitting this rule is unable to identify the application.

Re: Is New App ID Rule Setup Correctly?

BPry — Thu, 30 Mar 2023 15:40:59 GMT

@DuggiFresh,

Gonna go out on a limb and say that this is the first app-id based rule that you have in your rulebase? If that's the case, that'll match a whole lot of traffic as the firewall needs to allow enough traffic to identify the application. As soon as the application is identified, the firewall will reanlyze the rulebase and pass the traffic to the corresponding entry.

As long as this is the first app-id based rule that is in your rulebase, or is the first for at least a subset of your users, this is expected behavior.

Re: Is New App ID Rule Setup Correctly?

Raido_Rattameister — Thu, 30 Mar 2023 15:49:04 GMT

All outgoing connections that don't get past TCP 3way handshake will match your New Apps rule.

Find application that you permit out anyway and add rule above it to collect all incompletes.

Example below with traceroute.

Source - inside

Destination - outside

Application - traceroute

Service - any

Action - allow

This will collect all incomlete sessions and your chosen app and keep New Apps rule clean.

Re: Is New App ID Rule Setup Correctly?

DuggiFresh — Thu, 30 Mar 2023 15:55:14 GMT

So this rule should be near the bottom of my policies, below my identified apps? I have my applications identified in my policies.

Re: Is New App ID Rule Setup Correctly?

Raido_Rattameister — Thu, 30 Mar 2023 15:57:55 GMT

New Apps rule should be before any of other outgoing rules if you want to have correct reporting.

If you want to keep New Apps rule log clean you need to add incomplete collector rule above it according to my example from previous post.

Re: Is New App ID Rule Setup Correctly?

DuggiFresh — Thu, 30 Mar 2023 16:07:55 GMT

Thank you, Do I need new app ID rule for Inside to inside?