topic Re: How to disable App-ID for all applications in General Topics

How to disable App-ID for all applications

abarnett — Wed, 10 Oct 2012 17:25:00 GMT

Hello,

I've got two VWIRE pairs that see some duplicate traffic.

Basically:

VWIRE1 sees LAN to Internet

VWIRE2 sees LAN+DMZ to Internet.

What I'd like to do to free up some resources is disable inspection on one of those pairs for traffic when source IP matches a CIDR block. Creating a custom application doesn't work in this case.

Has anyone been able to do this?

thank you!

Andrew

Re: How to disable App-ID for all applications

ppatel — Wed, 10 Oct 2012 17:31:54 GMT

Andrew,

Here is the link to disable application inspection on the firewall for certain traffic.

https://live.paloaltonetworks.com/docs/DOC-2816

Create two custom applications under Objects>Applications

1 ) For tcp port, select under port :- tcp/dynamic

2) For UDP, select under port :udp/dynamic

Create two separate application override rules , one of tcp and the other for udp traffic.

One security rue will have protocol TCP and ports 0-65535

The other security rule will have protocol UDP and port 0-65535

Let me know if this helps.

Regards

Re: How to disable App-ID for all applications

kfindlen — Wed, 10 Oct 2012 17:32:23 GMT

Hi Andrew,

You should be able to use an application override policy with a custom application. The application override policy can be defined for a particular source or destination IP range/subnet. Any session which matches the app override policy will be classified as the custom application. This will also disable all layer 7 inspection on that traffic.

The document below gives further details.

https://live.paloaltonetworks.com/docs/DOC-1071

Thanks,

-- Kevin

Re: How to disable App-ID for all applications

ppatel — Wed, 10 Oct 2012 17:36:17 GMT

Andrew,

Once you create the application over ride rule along with the custom application and commit, you need to clear all the existing sessions from the firewall that uses inbuilt application

>clear session all

>clear session all filter source <x.x.x.x>

Now test the application override rule by sending traffic.

Regards

Parth