How work App-id when trafic is not inspected

Antoinenucera — Thu, 03 Dec 2020 10:34:53 GMT

Good morning all,
I have a question regarding the relationship between Appid and Ssl Decryption. How can the Fw recognize an application when the traffic is not inspected?
Example user request https://www.youtube.com/watch?v=2zB2jiCxxuQ. What is the Fw going to see? The source ip, the destination ip for www.youtube.com 142.250.74.238 the Fqdn www.youtube.com and the certificate presented by the server which in our case is a multi san
* .google.com, *. android.com, *. appengine.google.com, source.android.google.cn, urchin.com, www.goo.gl, youtu.be, youtube.com, youtubeeducation.com, youtubekids.com, yt.be and many more ...

In this case for me application recognition can only be based on FQDN and SANs is this correct? In this case App-id will be in "best effort" because it will not be able to recognize the signature of the application since the traffic is not inspected.
If my analysis is correct, does it really make sense to use App-Id in the rules when traffic is not inspected?

For exemple for Starleaf traking
( port.dst eq 24704 ) and ( addr.dst in 88.84.147.242 )
Traffic To 88.84.147.242 is not decrypt du to exclusion
Recognized apps are
unknown-udp Drop
starleaf allow
insufficient-data allow

Re: How work App-id when trafic is not inspected

reaper — Fri, 04 Dec 2020 09:33:16 GMT

the SNI is also used to help identify YouTube if you do not have ssl decryption enabled

unknown-udp would not be normally encrypted data and insufficient data mans there will probably only be 4 or 5 packets echsnged with no usable data to identify an application, you could set up a packetcapture to verify what this could be and either create a custom application, or submit the data to Palo Alto so the signature can be improved

topic How work App-id when trafic is not inspected in General Topics

How work App-id when trafic is not inspected

Re: How work App-id when trafic is not inspected