topic Re: How to find out the right app-id in General Topics

How to find out the right app-id

PatrickZhang — Tue, 08 Dec 2015 23:29:49 GMT

Hi all,

I started studying PA firewall recently and am struggling with finding out the APP-ID for some traffic. I can easily find out the services(or ports for CISCO ASA) and create the rules based on services/ports, but by doing this we will lose the visibility of application which is the reason we use PA in the first place.

So, use as much APP-ID as possible other than service/port will be very important. Ok, my question is, how can I find out the APP-id that I should use? As a network engineer, it's very challenging for me to get familiar with all the applications.

Anyone can give me some advices? Thanks a lot.

Patrick

Re: How to find out the right app-id

gwesson — Tue, 08 Dec 2015 23:36:49 GMT

Probably the easiest way to leverage App-ID while not knowing every single app is to use the Objects > Application Filters area to create collections of apps that you want to use. You can set up your policies to use those instead of individual apps, and still leverage the app-id database.

You can create a pretty complex set of app filters this way, so it can be as specific or generic as you want.

Beyond that, you can use port-based rules initially, and then over time you'll be able to see the apps used in your traffic logs. Then you can start creating app-based policies above the port-based policies, eventually phasing out the port-based ones as your app-based rules become more robust.

-Greg

Re: How to find out the right app-id

PatrickZhang — Wed, 09 Dec 2015 00:02:39 GMT

Hi Greg,

Yes, you are right, the logs are telling me the APP-ID, even I haven't configured it. Thank you very much!

Cheers,