What is Application Dependency?

[kiwi]

What is Application Dependency?

Application Dependency or "Depends on" (how it is listed inside of the Application details inside of Objects > Applications > application detail window) is a list of applications that are required for this application to work properly.

Why is it important to you?

If you do not allow the application and its dependency through the Palo Alto Networks firewall, then the application will not work.

Note: There is also a "Implicitly Use Applications" field that you need to recognize. The "Implicitly Use Applications" is a subset of "Depends on," and the dependent applications are implicitly allowed. The application still does depend on these applications, however they do NOT need to be explicitly permitted in security policy. Dependent applications can be allowed implicitly, when the firewall is able to determine the correct application by a specific point in the session.

For more information on checking Application Dependency, please see this doc:

Check if an Application Needs Explicitly Allowed Dependency Apps

Let's take two applications as examples: facebook-base and facebook-posting.

facebook-base:

 Looking at the application detail window for facebook-base, you can see 2 things listed:

1. 'Depends on' is blank. This means that it does not need any other applications to be allowed in the same rule for this to work.
2. 'Implicitly Uses' has SSL and web-browsing listed. This means that if you allow facebook-base, that it will also be allowing ssl and web-browsing applications implicitly.

This mean, if you allow facebook-base in a rule, no other applications are needed:

facebook-posting:

Looking at the application detail window for 'facebook-posting, you can see 2 things listed.

1. 'Depends on' has the following applications listed: facebook-base, facebook-apps and facebook-chat. This means that in order for this to work, one or more of the these applications need to be allowed in the same rule.
2. 'Implicitly Uses' has web-browsing listed. This means that if you allow facebook-posting, that it will also be allowing the web-browsing application implicitly.

So, in order to allow the facebook-posting application, you will have to add the 'Depends-on' applications in the same rule.  You can immediately select them when you select facebook-posting application and add them to your rule as displayed below (or you can also search and add them individually through the applications):

You'll end up with a rule that looks like this:

When the first TCP packet is received (SYN), the firewall must setup a session. Since the application can not be detected on a TCP session until at least one data packet traverses the device, the application will be incomplete.  For the firewall to determine if it should even allow the SYN packet through it must do a security policy lookup.

Because the application is not known when the SYN packet is received the application portion of the security policies can not be applied. As a result, the security policy lookup is performed against the 6 tuples of the session, source and destination IP and port, ingress interface (actually zone) and protocol. The first policy, which matches these 6 tuples, will be used to allow the SYN and any additional packets that traverse the firewall before the application is identified.

It is always a good idea to look at any new application details first to determine what the security rule might need to allow the application to work properly.

Also check the following links on the topic :

• Check if an Application Needs Explicitly Allowed Dependency Apps 
• Resolve Application Dependencies 
• Simplified Application Dependency Workflow 

Thanks for taking time to read this blog.

Don't forget to hit that Like (thumbs up) button and don't forget to subscribe to the LIVEcommunity Blog.

As always, we welcome all comments and feedback in the comments section below.

Kiwi out !

[Afonso_Alves]

Thanks for this article.

[JordanCobb]

Kiwi, 

You should write the docs for Palo Alto.  This is much better than anything in the official documentation.   Short, clear, and to the point, and the illustrations are spot on.    Thank you.

[hpdiy168]

Hi,

We export the PA3020 config import to PA1410 and loaded , there was no error. But when we verify the security rule-application-Depends On, under the Depends On the item not same.

Is this due to the version? What impact will it have? How to make both sides same? Details please check attachment, thanks.

[kiwi]

Hi @hpdiy168 ,

Apps can get modifications with each content update (see 16 modified app-ids in below screenshot):

Please refer to the following DOCs to Manage New and Modified App-IDs 

[hpdiy168]

Hi @kiwi 

how to make the Depends On same??

[hpdiy168]

@kiwi @JordanCobb @Afonso_Alves 

Hi all good day  

Has anyone encountered this situation? Is there any good solution?

[ET]

In the facebook-base example, the app Implicitly Uses SSL and web-browsing. Will it open SSL and web-browsing to any destination or to facebook only?

[kiwi]

@ET - When the firewall identifies facebook-base as the application and it implicitly uses SSL and web-browsing, these implicitly allowed applications are permitted only for the traffic associated with the facebook-base session itself, not for any destination universally.

[ET]

Is there an official documentation for this?

[ET]

Never mind - found it here
https://docs.paloaltonetworks.com/best-practices/security-policy-best-practices/security-policy-best...

Implicit applications, which the firewall automatically allows to support the specified application and which you don’t need to explicitly add to a rule. For example, in addition to the explicit applications required for facebook-chat to work properly, when you add facebook-chat to a rule the firewall automatically allows the applications jabber and web-browsing. (Unless you explicitly add them to a rule, jabber and web-browsing aren’t allowed for all traffic, just for the facebook-chat traffic.)

Thx