How to automate rules with App-ID

[MicahGawin]

How can you automate firewall rule creation when App-ID is used? This seems easy enough on a port-based firewall, but I have yet to see anything addressing APP-ID. A typcial flow could look like this:

user submits firewall request form

appropriate approvals submitted

automation handles the form 

automation provisions the firewall based on the approved user request

How are people handling the automation/form submittal process when App-ID is used? The APP-ID webpage provides information as to what applications are available but does not seem to fit the use case listed above.

Hope you are having a great day!

[drogers · Accepted solution]

One of the workflows I've seen allows users to select AppIDs on the FW CR form. Depending on your user base you could limit the AppID list to a curated selection, or do something fancy like filter based on which port the user selects.  You can pull the AppID DB from the firewalls/Panorama using the API, and the Application Default ports are listed for each AppID, so the data could come from there.

[MicahGawin]

Thanks! I was trying to parse the data from the App-ID website, I didnt realize I could use the local API.

[rhagen]

I like the curated selection approach that @drogers mentions because it will silmplify the request process and require less rework when the wrong application is selected.  Giving an end-user a choice of 3,000+ App-ID signatures would be asking for trouble.