Application Dependency question (l thought l knew it)

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Application Dependency question (l thought l knew it)

L6 Presenter



A bit confused now :0


My policy as below:




So port 80 is allowed when l attempting to connect to the device over the web browser (Chrome) but after Palo actually identified that this is not a "panos-web-interface" app (based on tcp 3 way handshake and some data) didn't the response to the request.  I understood that there is no other way to do it unless you got a sufficient data to identified the app hence fist packet is allow based on destination port and session is created. 


Another policy snip:




This may not be the best example but for "http-video" (along with other app`s) my Depends on Applications: web-browsing.

My question is what is classified as a web-browsing (it is purely any web-browser request or something more specific) and what else will be allowed if my policy permit two application: https-video and web-browsing? What if l will be surfing the lnternet over the Chrome doest it means that any web-browsing traffic (requests) is allowed and will be successful ? 





Accepted Solutions

The child app depends on the parent, because the child can only be identified _after_ the parent has been identified by AppID (the first thing AppID sees is the parent's behavior, so identifies as the parent, then the session starts to send child payload and AppID can change to the child app)

The parent app is sort of the transport layer for the child app



Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy

View solution in original post


Cyber Elite
Cyber Elite

any web based application will usually start off as web-browsing (hence the whole dependency thing)


when you start any web based session you'll first have the 3 way handshake, which does not permit you to identify any application short of using port 80, next comes a http get (this is web-browsing)

if all you are getting is an average website, the application will remain web-browsing


if, however, you go into more specific applications (http-video , facebook,.. ) AppID will change the application to what is most accurate


so for an application that has a dependency, it means that there is no way (for AppID) to anticipate the application will become the final application, without first having been the dependency app



hope this makes sense?

Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy

Hello @reaper


Thanks for clearing this up for me. Hmm. I thought in a bit different way. Let's say l do have an app dependent on the web-browsing (assume it is http-video as in out example). For http-video traffic/application to work you must meet both (web-browsing and http-video) criterias however, if  you are only meeting one criteria (especially when hitting dependent application only) in our case it is web-browsing traffic will not be permitted (after the firewall clearly identified that the app is pure web-browsing). When the session is created on PA, in the monitoring tab we only able to see a final application as a result of the session id engine scan? When we do > show session id xxxx  in the application field the app won't change or it can if l change the application from web-browsing to http-video:




Or it is going to be a completely new session?  Hope l am not confusing you or anyone or talking s**t:0 

The session ID will remain the same and theoretically if you're fast enough you could see each application as AppID goes through all the phases (if you log 'at session start' you should actually see all the phases as each 'morph' is a new start for the same session ID)

The criteria are sequential
At session setup it's the 5 tuples (src zone, src subnet, dst zone, dst subnet, dst port)
Next is 5 tuple + initial app/dependent app/parent app
Next 5 tuple + child app

To get to the child app you need to pass the previous security checks
Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy

The majority of the sessions that I deny I have log-start and log-end set to yes exactly for this reason. I like to be able to show to people that while we do block certain applications (bittorrent) it takes a quick second to actually id the traffic. That way when I get the lovely copyright notices I can argue with them about the legitimacy of the claim 😉 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!