Application Override Question

[Jonathan_Panes]

Hi All,

I got this question from the learning center for the PCNSE practice exam. Dont know if its allowed to post the screenshot here.

From my understanding of using the application override, the firewall stops any further content inspection. It was also stated on the admin guide:

If you define an application override, the firewall stops processing at Layer-4. The custom application name is assigned to the session to help identify it in the logs, and the traffic is not scanned for threats.

Does using a built-in application on an app-override policy allows the firewall to perform content and threat protection?

Thanks and regards,

Jon

[LukeBullimore · Accepted solution]

Hey Jon,

Layer7 processing for an app will only stop when using a PBF rule if you override the app to a custom one i.e "MyCustomApp". Overriding the traffic to an existing app such as web-browsing in this example will keep the content inspection enabled.

Thanks,

Luke.

[OtakarKlier · Accepted solution]

Hello,

So if you use Application Override, Content-ID does not occur.

• For example, if you build a custom application that triggers on a host header www.mywebsite.com, the
  packets are first identified as web-browsing and then are matched as your custom application (whose
  parent application is web-browsing). Because the parent application is web-browsing, the custom
  application is inspected at Layer-7 and scanned for content and vulnerabilities.
• 
  If you define an application override, the firewall stops processing at Layer-4. The custom application
  name is assigned to the session to help identify it in the logs, and the traffic is not scanned for threats.

This is from the admin guide on page 580.

Regards,

[OtakarKlier]

Hello,

Also as a side note. I have also looked at the practice exam and there do seem to be errors in the answers. Dont trust the practice questions, go by what the guides state.

Regards,

[Jonathan_Panes]

Thanks for the reply.

So just to confirm, threat content scanning will still be enabled for app-override policies using:

1. pre-built applicaition

2. custom application with a pre-built parent app

??