Custom App-ID with just source and destination ip address

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Custom App-ID with just source and destination ip address

L1 Bithead

Hi,

 

I have some traffic on a tap interface that I would like to create an APP-ID to identify it in the monitor logs. This a seperate network with its own custom application and functions. I have done some pcap's and can't see distinct data that relate to the context values in the custom App-ID form. Is there a list of what the context values are/mean?   Is it possible to just create an App-ID with the source-ipaddress:port and destination-ipaddress:port? There are multiple sources talking to multiple servers but it is not a generic application available on the internet.  The ports seem to be distinct from the common ports used in other applications.

Any help at all would be very gratefully recieved.

4 REPLIES 4

Cyber Elite
Cyber Elite

Hi @ConorMc ,

 

Yes, you can use Application Override to assign traffic to custom applications.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0

 

This 1st step for Application Override is to define the custom application.  If the source or destination port is consistent, you can define that in the custom application.

 

Then you create your Application Override policy based upon the source and/or destination IP addresses.  The traffic will then be assigned the custom App-ID and you can track it in your logs and use it in your security policy.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Thanks for your help Tom,

I'll look at that now. Just a question, this seems to bypass the Content and Threat inspection for the traffic. I need the traffic to be inspected for malware etc. The system is an IDS for traffic on private networks that is sent to the Firewall tap interface. 

Regards,

Conor.

Cyber Elite
Cyber Elite

Hi @ConorMc ,

 

You are correct.  Application Override will bypass content inspection (Content-ID).  If you do not have a parent app (see below), you may as well go this route.

 

Custom apps without a signature will not match traffic without Application Override.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGvCAK

 

In order for your custom app to be inspected at L7, you will need to identify a parent app and check at least one of the boxes under the Scanning section on the Advanced tab.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK

 

Yes, there is a list of the context values!  https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-...

 

For unknown apps, you could use one or more of these 4 string contexts:

 

unknown-req-tcp-payload

unknown-rsp-tcp-payload

unknown-req-udp-payload

unknown-rsp-udp-payload

 

That will instruct the inspection engine to search for your regex starting with the payload portion of the TCP or UDP packet.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmGCAS

 

Shout out to @OtakarKlier for the helpful links!  https://live.paloaltonetworks.com/t5/general-topics/urgent-custom-application-issue/td-p/312239

 

Thanks,

 

Tom

 

Help the community: Like helpful comments and mark solutions.

Thanks Tom,

Excellent information and alot to have a go at. I'll look at the pcap's and see if I can get a pattern match for the tcp traffic.

 

Thanks again, 

  • 283 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!