topic Re: Application override in General Topics

Application override

Sarou22 — Mon, 29 Jul 2024 13:38:00 GMT

Hello,

Application Override to a custom application will force the firewall to bypass Content and Threat inspection

I've read several documents but I still don't understand the point of doing this. What's the point?

Thanks

Re: Application override

Alejandro_Hernandez — Mon, 29 Jul 2024 20:05:25 GMT

Hi @Sarou22

Application override forcibly bypasses the AppID process and sets a session to match a manually configured Application name. Any sessions processed like this will not be scanned by parallel processing and will be offloaded to fastpath

For most use cases, we recommend creating a simple custom application with as few attributes as possible, as the app override will bypass scanning or signature detection. It will simply identify a session as the custom application and take no further action. This can be a very simple but powerful tool to help identify internal applications and improve throughput as the session is offloaded to hardware immediately, but please consider the security implications.

The following links explain with more details about Application Override

https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-create-an-application-override/ba-p/451872/redirect_from_archived_page/true

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

Re: Application override

MP18 — Mon, 29 Jul 2024 20:54:13 GMT

@Sarou22 Please read this

In general, you would use an application override policy if your custom application is not being correctly detected AND the PA is assigning the flow to a DIFFERENT built in application.

The application override then prevents the upper layer inspection as and thus prevents the misclassification of the traffic.

If your custom application successfully matches the traffic, then no application override is needed.

Regards

Re: Application override

Sarou22 — Mon, 29 Jul 2024 21:50:15 GMT

Thank you very much