APP ID impact

[BNSRIKAR]

Can some one answer this?

A security administrator has configured App-ID updates to be automatically downloaded and installed. The company is currently using an application identified by
App-ID as SuperApp_base. On a content update notice, Palo Alto Networks is adding new app signatures labeled SuperApp_chat and SuperApp_download, which
will be deployed in 30 days. Based on the information, how is the SuperApp traffic affected after the 30 days have passed?
A. All traffic matching the SuperApp_chat, and SuperApp_download is denied because it no longer matches the SuperApp-base application
B. No impact because the apps were automatically downloaded and installed
C. No impact because the firewall automatically adds the rules to the App-ID interface
D. All traffic matching the SuperApp_base, SuperApp_chat, and SuperApp_download is denied until the security administrator approves the applications

App-ID 

[Adrian_Jensen]

You don't explicitly say, but I assume from your example "The company is currently using an application..." that the company has explicitly allowed "SuperApp_base" in a policy rule. Therefore, the answer would be closest (though not exactly) B.

App ID is normally updated automatically (and includes Threat ID which you would want to update frequently). The "_base" App ID is a superset category that includes underlying communication channels and subsets of specific features. So SuperApp_base would match SuperApp_chat, SuperApp_download, SuperApp_audio, SuperApp_video, and any other more specific application IDs. If you wanted to allow all SuperApp applications except for chat, you could do an allow rule for SuperApp_base** and a deny rule for SuperApp_chat.

** - If you already have a general allow rule for anything not explicitly denied, then you don't really need a SuperApp_base allow rule. Also, because of the mixed traffic nature in a "SuperApp" that does lots of different things in a common communication channel, but you want to block a only a specific subset, matching will never be 100% effective.

Application ID updates will never change your policy rules or add applications to a policy, though traffic that was at one time identified as application "A" may now be identified as "B" causing it to go thru a different policy. If you application was identified as "A_base" before the update and now is more specifically identified as "A_subset", then it will follow the "A_base" policy if there is not a more specific policy.

[aleksandar.astardzhiev · Accepted solution]

Hi @BNSRIKAR ,

Unfortunately I don't agree with @Adrian_Jensen  and I would go with anwser A

- I believe the confustion here is between "container app" and xxx-base app. What @Adrian_Jensen described is actually the definitiaon for container app - following link probably will explain it better than me - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltnCAC

- Take for example SMB (because facebook contain too many sub-apps).

As you can see there Palo Alto provide specific signature for each SMB version, so you can have more granula control and allow/deny specific version. If SMB version doesn't bothers you and you want to allow all versions you can simply add the container app - the parent from this three. As Adrian explained if you do that any future SMB version or app signature will be included in your policy automatically.

- Now lets focus on the xxx-base application - think about how firewall identify actuall application - first it needs to allow the TCP session to establish, then endpoints will start transfering some data, with each data firewall will gather more information, which is used to identify the actuall application. xxx-base application is used when Palo Alto can identify that traffic is associated with given application, but either not enough data is processed to identify the exact fucntion/feature, or just firewall doesn't have more specific app signature.

- Going back to the question form your exam prem - Firewall has signature for "supperApp-base", at this point any traffic and feature of this app is associated with -base app-id. At some point Palo Alto have created more specific signatures that allows you to identify specific features of this app, like chat and file download. Once the new content is installed on the firewall it will be able to identify each feature of this application, but this will also means that it will block that traffc - because your policy does not allow the new applications.

[Adrian_Jensen]

After looking at an app category while chasing a different problem this afternoon, I have to agree with @aleksandar.astardzhiev. I screwed up the earlier definition. SuperApp would be the superset category, SuperApp_base would be a subset that includes underlying communication and shared features. SuperApp_chat would be a subset of the chat features. If the chat feature was moved out of SuperApp_base to a new signature SuperApp_chat, then it would no longer match in the original rule explicitly allowing that.