Packet Flow Sequence and Application Override

[Michel.Thay]

Hello everyone,

I have a question regarding the "AppID override" ,

In this article "https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0" we can read the following:

"
Special Note about Content and Threat inspection
Application Override to a custom application will force the firewall to bypass Content and Threat inspection for the traffic that is matching the override rule. The exception to this is when you override to a pre-defined application that supports threat inspection.
"

However, in the PaloAlto Packet Flow Sequence (available : http://live.paloaltonetworks.com//t5/image/serverpage/image-id/12862i950F549C7D4E6309) we can see this :

When the application override policy is matched the only step skiped is [Pattern-based application identification]. The "Content Inspection (SP3/CTD)" is allways performed, regardless of the application override. So the Content profiles seem to be applyed.

So my question is the following: is something missing from the diagram or am I wrongly reading the graph ?

Many thanks,
Karim BENYELLOUL

[Karim.Benyelloul]

any update on this please ? 🙂 

[bagherib]

Interesting question.  Have you tried testing this on a FW and looking into the logs?  

[Karim.Benyelloul]

Yes, it works as described in the article here "https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0" ... either I misunderstand something or the Packet flow is a bit missleading 😞 

[alestevez]

Hi, I will recommend close this threat here and re open it under the Firewall Community, This is for Expedition and it doesnt capture the attention of everybody 🙂