application override

[lisiecki]

Do I require a security rule if I create an application override rule?

[SRA]

yes, you will need a security policy rule to allow/block the custom app from your app override rule.

[mgp]

Hi lisiecki,

If we see in https://live.paloaltonetworks.com/docs/DOC-2344, there will be no scanning performed on the session in Application Override.

[sraghunandan]

Also refer https://live.paloaltonetworks.com/docs/DOC-1071

[santonic]

I have a related question about application override.

Let's say we created custom app my-telnet.

Then we created an application override rule which identifies traffic let's say from network 10.10.10.0/24 to host 172.24.24.24 on port 24 as my-telnet

In security rules we have a more general rule allowing traffic from 10.0.0.0/8 to 172.24.0.0/16 for all applications on all ports. (so basically custom application my-telnet is not used anywhere in security policy)

Will session from 10.10.10.0/24 to host 172.24.24.24 on port 24 be recognised as my-telnet?