I am working with a client in an interesting situation..
We are basically needing to limit sections of the network where certain users and login to a web server. For example, only admins can login from zone1 and only users can login from zone2. The application on the web server is not a custom one built by the client but there is no current ID for it in the app-id db.
Currently, we would like to make the policy decisions based on app.. and have a separate ID based on admins or users.
I created an APP-ID for the application itself and tested it; it works! I also checked "Continue scanning for other applications".
Next, I used a proxy to monitor the packets and found that the username is submitted via HTTP PARAMS. So, I cloned the original APP-ID and made a new one (we will call it App-User). I added an AND condition to the original signature and it looks for:
pattern: user (I have also tried username=user).
Qualifier is http method = POST.
After committing this.. the PAN IDs the traffic as the original APP-ID but does NOT change the app identified once someone sends posts requests with the specific username identified.
Will this not work in the manner I think it would? Any better suggestions?
FWIW: I don't have to create an AND rule for each user. The user base all share a generic ID for this system.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!