Application overrides

Alex_Samad — Wed, 21 Jun 2017 00:13:41 GMT

So I ran ito the 150 application over rides limit.

At my location I have a lot of java app running, they normally provide a http interface a JMX and RMI and https interface. and when you have 15 -20 of these that suchs up a lot of application override

I don't want the PA's inspecting the flows.

First I tried creating my custom application and provided the ports. But cause it is HTTP traffic the PA;s would classify it as web-browsing. I don't want this. So I found the only way to over ride this was to use applicaiton overrides.

So for auditing I created an application over ride for each port and application......

Now I am stuck ... added my 151 applicaiton override in panorama and tried to push out and it failed ...

Now I am rethinking. Currenty thinking I might group my applicaiton overrides. For example all the applicaitons have a http port and typically a RMI and JMX port. I thought I could have a generic JMX port over ride and lump in all the port numbers in the application override object.

then my next tricky thing was create a custom applicaiton say JMX port and sub applications say JMX app1, JMX app2.

So applicaiton override would say applicaiton override is JMX and hopefully because jmx has children custom apps called jmx app1 and jmxapp2 it will pick them based upon the port number .

Or is there any other way of doing this ??

is there a way to force my custom applicataions to have higher priority over the inbuild ones - especially web browser

Re: Application overrides

reaper — Wed, 21 Jun 2017 07:39:33 GMT

AppID will always try to identify the most accurate definition of an application

so if you write a custom app that triggers on a signature, the custom app should be triggered

if you can only provide some ports and the application behaves like web-browsing, web-browsing will be more accurate

the 'other' way is to use app override

why don't you want the PA's to inspect the flow? if you're accidentally hitting vulnerabilities, you can create override (in the threat/av/as), if AppID is the issue you can set up packetcapture and write signatures to properly identify the custom apps and no longer have the override issue

here's an artiicle that may help

Getting Started: Custom applications and app override

topic Re: Application overrides in General Topics

Application overrides

Re: Application overrides