Custom App-ID with just source and destination ip address

[ConorMc]

Hi,

I have some traffic on a tap interface that I would like to create an APP-ID to identify it in the monitor logs. This a seperate network with its own custom application and functions. I have done some pcap's and can't see distinct data that relate to the context values in the custom App-ID form. Is there a list of what the context values are/mean?   Is it possible to just create an App-ID with the source-ipaddress:port and destination-ipaddress:port? There are multiple sources talking to multiple servers but it is not a generic application available on the internet.  The ports seem to be distinct from the common ports used in other applications.

Any help at all would be very gratefully recieved.

[TomYoung]

Hi @ConorMc ,

Yes, you can use Application Override to assign traffic to custom applications.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0

This 1st step for Application Override is to define the custom application.  If the source or destination port is consistent, you can define that in the custom application.

Then you create your Application Override policy based upon the source and/or destination IP addresses.  The traffic will then be assigned the custom App-ID and you can track it in your logs and use it in your security policy.

Thanks,

Tom

[ConorMc]

Thanks for your help Tom,

I'll look at that now. Just a question, this seems to bypass the Content and Threat inspection for the traffic. I need the traffic to be inspected for malware etc. The system is an IDS for traffic on private networks that is sent to the Firewall tap interface. 

Regards,

Conor.

[TomYoung]

Hi @ConorMc ,

You are correct.  Application Override will bypass content inspection (Content-ID).  If you do not have a parent app (see below), you may as well go this route.

Custom apps without a signature will not match traffic without Application Override.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGvCAK

In order for your custom app to be inspected at L7, you will need to identify a parent app and check at least one of the boxes under the Scanning section on the Advanced tab.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK

Yes, there is a list of the context values!  https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-...

For unknown apps, you could use one or more of these 4 string contexts:

unknown-req-tcp-payload

unknown-rsp-tcp-payload

unknown-req-udp-payload

unknown-rsp-udp-payload

That will instruct the inspection engine to search for your regex starting with the payload portion of the TCP or UDP packet.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmGCAS

Shout out to @OtakarKlier for the helpful links!  https://live.paloaltonetworks.com/t5/general-topics/urgent-custom-application-issue/td-p/312239

Thanks,

Tom

[ConorMc]

Thanks Tom,

Excellent information and alot to have a go at. I'll look at the pcap's and see if I can get a pattern match for the tcp traffic.

Thanks again,