APP-ID and HIgh Port range

[clyde.franklin]

Is ther a range of tcp/udp ports that do not have a APP-ID in appipedia? I ask b/c as we are migrationg over 10k rules we are aware not all of them will have PA app-id assoicated so we are trying to filter out those ports and jsut curious is there a acutal port range or specific ports that do not have APPID's

[reaper]

hi @clyde.franklin

App-ID works slightly different

each appliucation does have a default port, but app-id will work across all ports : if you open a webserver's port 15999 for example app-id will identify web-browsing because it sees the http GET

the port associated to web-browsing will only be detrimental when your security policy has 'application-default' in the security policy, which limits which ports are allowed by initial SYN packets

eg. if there is only 1 with web-browsing and DNS and service app-default, then the drop rule only SYN packets on ports 80, 8080 and 53 will be allowed

if the service for that rule is set to 'any', all ports will be allowed, but as soon as payload starts to flow and app-id is not able to match web-browsing or DNS the session will be discarded

there are also a few apps that are tcp/dynamic, which means they are supposed to use any random port

if you're migrating from a different platform a good method is, for any rules that have you wondering which apps are hit, to duplicate the policy and add the apps you know in the top rule, then run reports/show logs on the second rule to see which apps you've missed, then add them to the top rule till there are no more sessions hitting the second policy, or only unwanted apps hit it, then delete the rule