topic Re: Custom Application Signature in General Topics

Custom Application Signature

CARRIERJerome — Thu, 02 Jul 2020 15:08:18 GMT

Hello

For the same application, I have several links and ports (https://application.intra.mydomin.corp:8530/toto, https://application.intra.mydomin.corp:8130/titi, https://application.mydomin.corp:8530/toto,..) and I would like to create a rule and specify the application and not a rule based on the protocol.

How I can create a custom application who match with my example ?

Re: Custom Application Signature

Remo — Thu, 02 Jul 2020 20:45:06 GMT

Hi @CARRIERJerome

Some help with creating a custom application signature you can find here in this knowledgebase article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

With your example:

Do you have TLS decryption enabled? If not, you will only be able to filter based on the fqdn. What you could do also - instead of creating a custom app - is using a custom url category and simply use this custom url category in your security policy rule (this does not require URL filtering license).

Regards,

Remo

Re: Custom Application Signature

CARRIERJerome — Thu, 02 Jul 2020 20:57:03 GMT

Hello

My goal is to create an generic signature because my application has not always the sale fqdn but I have always the /toto or /titi after (application1.intra.domain.corp/toto, application1.intra.domain.corp/titi, application1.ext.domain.corp/toto,...). Is it possible and how I can create a signature based on *.intra.domain.corp/toto or *.intra.domain.corp/titi or *.ext.domain.corp/toto?

Re: Custom Application Signature

CARRIERJerome — Fri, 03 Jul 2020 06:47:02 GMT

I forgot to precise : our application uses differents port such as application1.intra.domain.corp/8085/toto, or application1.intra.domain.corp:8585/titi or application1.ext.domain.corp/8085/toto..