topic Re: SSL web-browsing traffic being labelled as "adobe-creative-cloud-base" application in General Topics

SSL web-browsing traffic being labelled as "adobe-creative-cloud-base" application

StuartPenrose — Thu, 17 Mar 2016 02:05:27 GMT

Hi,

We have an issue where almost all our SSL traffic is being labelled as "adobe-creative-cloud-base" application.

Even me browsing this site with Chrome is showing as this Application.

Any ideas?

I'm very new to Palo. Love it so far.

Cheers

Stu

Re: SSL web-browsing traffic being labelled as "adobe-creative-cloud-base" application

pankaku — Thu, 17 Mar 2016 05:05:01 GMT

We have to find out if that traffic is actually a "adobe-creative-cloud-base" or not. even if you are trying to do a web-browsing it will not consider that traffic as web-browsing. Let say you are using facebook so it is actually as SSL port 443 traffic and you are doing a web-browsing but PA firewall will find out what kind of application it is and it will classify it as facebook application.

Check the following link as well.

https://www.paloaltonetworks.com/technologies/app-id

Hope this helps!

Re: SSL web-browsing traffic being labelled as "adobe-creative-cloud-base" application

StuartPenrose — Thu, 17 Mar 2016 05:29:37 GMT

Thanks for the responce Pankaj.

I can confirm it is not this application in most cases. I and most of the users here do not have anything adobe running and not connecting to Adobe sites.

Using your example - When I browse facebook, this site, gmail etc or anything on https. It is labelling the Application as "adobe-creative-cloud-base".

It appears to be doing this on only one of our Networks/Rules. "Corporate_Network_Policy"

Below is me browsing this "live.paloaltonetworks.com" In Google Chrome

Re: SSL web-browsing traffic being labelled as "adobe-creative-cloud-base" application

Raido_Rattameister — Thu, 17 Mar 2016 08:58:10 GMT

Can you check that there is nothing set under Policy >Application override

Re: SSL web-browsing traffic being labelled as "adobe-creative-cloud-base" application

StuartPenrose — Thu, 17 Mar 2016 09:59:02 GMT

Thank you Raido!

No idea why someone configured that 😕