topic Re: Custom App signature and App pushed from PA update in General Topics

Custom App signature and App pushed from PA update

MP18 — Sat, 27 Oct 2018 05:42:54 GMT

What if we create creates a custom application containing Layer 7 signatures.

And after few days the PA send the Latest APP and Threat updates and we download those in the PA

What will happen if the update contains an application that matches the same traffic signatures as the custom application?

which thing is hit first custom app or application pushed from PA when both have same signatures?

My understanding is that Custom APP should have preference?

Re: Custom App signature and App pushed from PA update

JW6224 — Mon, 29 Oct 2018 13:29:47 GMT

I found a KB article that speaks directly to your question.

It supports your understanding - Custom App-ID > predefined applications:

Custom Applications take precedence over predefined applications (including new Applications released in content updates) for matching traffic types when the traffic matches both a custom and local pattern. This is also true for VSYS specific custom applications (applications defined for individual VSYS).

Note: This action will take affect on the traffic immediately after a commit completes.

The Custom App will be matched without modifications to the security policy when a rule is defined with "application any". This occurs automatically even if the Custom Application is not used in a security policy or forced through the App Override when matching a rule with "application any", so long as the new application signature is defined correctly.

Re: Custom App signature and App pushed from PA update

MP18 — Mon, 29 Oct 2018 13:53:27 GMT

Many Thanks I was exactly looking for that.