Application override

[Sarou22]

Hello,

Application Override to a custom application will force the firewall to bypass Content and Threat inspection

I've read several documents but I still don't understand the point of doing this. What's the point?

Thanks

[Alejandro_Hernandez]

Hi @Sarou22 

Application override forcibly bypasses the AppID process and sets a session to match a manually configured Application name. Any sessions processed like this will not be scanned by parallel processing and will be offloaded to fastpath

For most use cases, we recommend creating a simple custom application with as few attributes as possible, as the app override will bypass scanning or signature detection. It will simply identify a session as the custom application and take no further action. This can be a very simple but powerful tool to help identify internal applications and improve throughput as the session is offloaded to hardware immediately, but please consider the security implications.

The following links explain with more details about Application Override

https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-create-an-application-ov...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRoCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

[MP18 · Accepted solution]

@Sarou22   Please read this 

In general, you would use an application override policy if your custom application is not being correctly detected AND the PA is assigning the flow to a DIFFERENT built in application.

The application override then prevents the upper layer inspection as and thus prevents the misclassification of the traffic.

If your custom application successfully matches the traffic, then no application override is needed.

Regards

[Sarou22]

Thank you very much