topic Re: Custom Application Signatures in General Topics

Custom Application Signatures

zthiel — Fri, 16 Mar 2018 14:03:00 GMT

Curious if anyone is successfully using the commvault application within their Palo Alto application policies? We tried it and it is not working at all to detect our CommVault application traffic. The details on the application itself seem quite old.

Re: Custom Application Signatures

reaper — Fri, 16 Mar 2018 15:01:47 GMT

was there a related question about custom signatures? 😛

the commvault app was last updated in august, so it's possible something was changed in the latest incarnation that causes it to not be identigfied properly in App-ID, you could reach out to support to have this investigated (they'll need packetcaptures and logs to verify)

Re: Custom Application Signatures

BPry — Fri, 16 Mar 2018 17:05:10 GMT

@zthiel,

Or if you really hate dealing with support and simply want the traffic to identify as CommVault, you could do like I've done and simply utilize an Application override policy and setup the traffic to match to commvault. It's lazy and stops the inspection at Layer4, but I still get to yell at my backup admin for using an ass-ton of bandwidth 😉

Re: Custom Application Signatures

zthiel — Mon, 19 Mar 2018 15:51:06 GMT

I'm just confused as to why the standard ports are: tcp/dynamic and not itimized out ports\protocols.

Re: Custom Application Signatures

BPry — Mon, 19 Mar 2018 15:57:22 GMT

@zthiel,

I don't know enough about how commvault is actually configured to properly answer that question. I would assume that it's to do with the fact that you can customize commvault's ports and that it doesn't utilize only a standard set of ports by default?