topic Re: Identifying Applications in General Topics

Identifying Applications

Jack_Howells — Thu, 16 Jun 2016 10:19:37 GMT

Hi guys,

Got an odd one here. Traffic is being identified as a completely different application to what the traffic actually is. For example, see below.

I've cleared the dataplane cache and re-downloaded the DB categorisation as per the document below, but to no avail.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Handle-a-URL-Miscategorization/ta-p/52733

Anyone experienced this before? Device is running 7.1.2 and apps and threats are up to date.

Cheers

Jack

Re: Identifying Applications

pankaku — Thu, 16 Jun 2016 20:17:31 GMT

what do you see when you run the command

test url <URL>

Re: Identifying Applications

pankaku — Thu, 16 Jun 2016 20:19:30 GMT

You can also try:

debug dataplane reset appid cache

Re: Identifying Applications

Jack_Howells — Fri, 17 Jun 2016 08:29:49 GMT

Hi Pankaj,

Thanks for your reponse.

I have tried all of this to no avail. It looks like a buggy app-id engine.

If I apply the URL filtering profile to the policy the issue occurs, however if there isn't a URL filtering profile, and I check the traffic logs, the application is identified correctly.

This case is being escalated to a higher tier for now. Just in case anyone experiences the same issue, I will update this as the case progresses and interesting information comes in.

Cheers

Jack