topic Re: Unknown App-ID in General Topics

Unknown App-ID

yu_jie — Wed, 26 Nov 2014 07:09:04 GMT

I noticed from Taffic Logs there are some App-ID that couldn't be found in Object (non-syn-tcp and incomplete). Is there any resources we can look for more description?

Re: Unknown App-ID

Retired Member — Wed, 26 Nov 2014 07:12:33 GMT

Incomplete, Insufficient data and Not-applicable in the application field

Re: Unknown App-ID

Retired Member — Wed, 26 Nov 2014 07:13:35 GMT

by default non-syn tcp is dropped.You probably changed the behaviour from zone protection or with command(global setting)

Re: Unknown App-ID

Retired Member — Wed, 26 Nov 2014 07:16:01 GMT

Here is the detail about that

How to Determine the Number of Non-SYN TCP Packets Being Rejected?

Is it Possible to Allow Asymmetric Traffic from a Different Zone on a Palo Alto Networks Firewall?

How to Set the Palo Alto Networks Firewall to Allow non-Syn First Packet

Re: Unknown App-ID

yu_jie — Wed, 26 Nov 2014 07:17:20 GMT

Yes due to asymmetric routing in customer environment, we disabled "Reject Non-SYN TCP" in zone protection.

Re: Unknown App-ID

Retired Member — Wed, 26 Nov 2014 07:18:11 GMT

you cannot identify an application from non-stateful traffic.This is normal.