topic Re: App id in General Topics

App id

Sarou22 — Mon, 29 Jul 2024 13:16:58 GMT

Hello,

I have a question about app id.

The App-ID description contains a Deny Action description of the action taken.

Whatever action is imposed by the security policy, the flow will follow the action of the App Id?

Re: App id

BPry — Mon, 29 Jul 2024 13:29:00 GMT

@Sarou22,

This depends on what security rule the traffic is hitting and the action applied to that rule. You can learn more about how this actually works by looking at the action documentation HERE, but in short you can override the application default deny action by specifying anything other than deny in your policy.

Re: App id

Sarou22 — Mon, 29 Jul 2024 13:36:26 GMT

If in my policy action is drop

and the App Id action is deny reset.

Which action will the firewall choose?

Re: App id

reaper — Tue, 30 Jul 2024 08:26:12 GMT

The deny action in APP-ID will customize what the firewall does if you create a deny security rule:

The allow, drop, and reset actions will set the same action for all sessions

The Deny action however, will block the connection, but will apply the action dictated by the app-id

This means that some applications will cause RST packets to be sent when blocked, while others may be silently discarded