App id

[Sarou22]

Hello,

I have a question about app id.

The App-ID description contains a Deny Action description of the action taken.

Whatever action is imposed by the security policy, the flow will follow the action of the App Id?

[BPry]

@Sarou22,

This depends on what security rule the traffic is hitting and the action applied to that rule. You can learn more about how this actually works by looking at the action documentation HERE, but in short you can override the application default deny action by specifying anything other than deny in your policy.

[Sarou22]

If in my policy action is drop

and the App Id action is deny reset.

Which action will the firewall choose?

[reaper]

The deny action in APP-ID will customize what the firewall does if you create a deny security rule:

The allow, drop, and reset actions will set the same action for all sessions

The Deny action however, will block the connection, but will apply the action dictated by the app-id

This means that some applications will cause RST packets to be sent when blocked, while others may be silently discarded