topic Re: Custom App-ID vs "Unknown-UDP" in General Topics

Custom App-ID vs "Unknown-UDP"

DPoppleton — Wed, 15 Mar 2017 14:48:26 GMT

If I create a custom app-id for an application we use, will it no longer match the "unknown-udp" (which we block)? Or do I need to do an application override as well?

Re: Custom App-ID vs "Unknown-UDP"

TranceforLife — Wed, 15 Mar 2017 15:03:54 GMT

If you create a custom app and your traffic matching your NEW application then no need to override it. APP Override as easy as I can explain is inspection up to layer 4 (TCP/UDP ports). After traffic is hitting correct port your app is identified so no other checks applies by app id if that makes sense :0

Re: Custom App-ID vs "Unknown-UDP"

DPoppleton — Wed, 15 Mar 2017 15:11:36 GMT

Thank you, that is the best explanation I've seen and I have been searching around for a while!

I'll give the new App-ID a try.

Re: Custom App-ID vs "Unknown-UDP"

TranceforLife — Wed, 15 Mar 2017 15:15:19 GMT

The video below will help you to create a custom app:

https://www.youtube.com/watch?v=CwXdWJpw0UY

If the custom app (on its own) wouldn't work when add a app override policy so app id inspection will be only up to layer 4.

Re: Custom App-ID vs "Unknown-UDP"

reaper — Thu, 16 Mar 2017 09:42:51 GMT

please check this article also: Getting Started: Custom applications and app override

If you are able to add any sort of signature to help identify your session, the custom app will function like any other application AppID can identify

if this is not possible, an app override may be required to force the app to be identified as your custom app (but this will restrict content scanning)

Re: Custom App-ID vs "Unknown-UDP"

DPoppleton — Thu, 16 Mar 2017 18:55:31 GMT

I have a 24 byte string the client always sends to open the communication. I have created a custom app-id, but the user is out until next week so I have to wait to see if it works.

Re: Custom App-ID vs "Unknown-UDP"

DPoppleton — Fri, 24 Mar 2017 20:15:53 GMT

I've given up on the app id.. from what I have read in the documentation the 24-byte string in the beginning of the communication isn;t enough. I had to do an "unknown-req-udp-payload" context. To use that you have to use the full payload to match, but the full packet isn't always the same.

So off to override land I go.