How to disable App-ID for all applications

Reply
Highlighted
L0 Member

How to disable App-ID for all applications

Hello,

I've got two VWIRE pairs that see some duplicate traffic. 

Basically:

VWIRE1 sees LAN to Internet

VWIRE2 sees LAN+DMZ to Internet.

What I'd like to do to free up some resources is disable inspection on one of those pairs for traffic when source IP matches a CIDR block.  Creating a custom application doesn't work in this case.

Has anyone been able to do this?

thank you!

Andrew

L4 Transporter

Re: How to disable App-ID for all applications

Andrew,

Here is the link to disable application inspection on the firewall for certain traffic.

https://live.paloaltonetworks.com/docs/DOC-2816

Create two custom applications under Objects>Applications

1 )  For tcp port,  select under port :- tcp/dynamic

2) For UDP, select under port :udp/dynamic

Create two separate application override rules , one of tcp and the other for udp traffic.

One security rue will have protocol TCP  and ports 0-65535

The other security rule will have protocol UDP and port 0-65535

Let me know if this helps.

Regards

L4 Transporter

Re: How to disable App-ID for all applications

Hi Andrew,

You should be able to use an application override policy with a custom application.  The application override policy can be defined for a particular source or destination IP range/subnet.  Any session which matches the app override policy will be classified as the custom application.  This will also disable all layer 7 inspection on that traffic.

The document below gives further details.

https://live.paloaltonetworks.com/docs/DOC-1071

Thanks,

-- Kevin

L4 Transporter

Re: How to disable App-ID for all applications

Andrew,

Once you create the application over ride rule along with the custom application and commit, you need to clear all the existing sessions from the firewall that uses inbuilt application

>clear session all

OR

>clear session all filter source <x.x.x.x>

Now test the application override rule by sending traffic.

Regards

Parth

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!