topic PA apps in General Topics

PA apps

soporteseguridad — Wed, 02 Aug 2017 09:38:52 GMT

Hi,

We are expecting problem with PA identifying apps.

We have sessions in port 13000 being identified as play-station network. These sessions are not related to Pstation.

On the another hand, we also have sessions in port 80 being identified as unknown-tcp.

why PA is idenfitying like this?? how can we solve this app problem??

Re: PA apps

TranceforLife — Wed, 02 Aug 2017 09:48:28 GMT

You can get PCAP from these sessions as well as try to reinstall newer app-database or even reinstall already existing one. But be honest, not sure what is going on.

Re: PA apps

BPry — Wed, 02 Aug 2017 15:17:41 GMT

@soporteseguridad,

unknown-tcp sessions are fairly common and are exactly that, usually it's because the session didn't actually process enough traffic to identify the app-id or the app-id simply doesn't exist.

The playstation-network identification is odd simply because the application doesn't actually use that port range by default. My guess is that you are not decrypting the traffic and therefore the firewall is trying it's best but will have false-positives or miss app-ids at times simply based off of how the feature functions and the amount of information it can see with the information it has access to without SSL decryption enabled.

As @TranceforLife stated the best course of action would be taking PCAPs and attempting to figure out what the traffic actually is. If the traffic is known you can build out a custom application signature to identify the traffic correctly and if you can identify it further you can pass the infromation along so that Palo Alto can attempt to narrow the application signature if at all possible so it's not flagging traffic incorrectly.