Blocking Application Filters

[EdwinD]

I've browsed through these forums regarding the best way to block applications.  I've saw the posts of folks blocking applications by app filter.

I have AD integrated AD groups.  These groups tie to individual Palo Alto security rules that allow any port any service as the destination, and then use group profiles to block specific categories.

I am in the process of creating a rule above most of these AD LDAP group rules that contains all my blocked applications filters.   Since I'm allowing any destination port, not just 80 and 443, I'm not sure what exactly I should block by app-ID.  I'm thinking of creating individual application filters based on the subcategories I want to block, such as voip-video, storage-backup, proxy, encrypted-tunnel, e-mail...   And putting all these application filters in this block rule.   I do understand that I run the risk of a new app-ID blocking things I did not want blocked.

I'm curious what others are doing.  There are over 1500 app-IDs.  Are you creating a application group and adding the 1000 you want blocked, or using filters?   I'm interested in alternate approaches to this.

Thanks!

[mikand]

Appfilters is to create a custom "group" based on category, subcategory, risk or some other column.

When you setup an application group you add each appid you want into this group.

Also note that a flow can (today) only have a single appid.

Which gives that if you have security policies to allow traffic you will only need a "deny+log" as last rule to keep this tidy.

You could however use appfilter in combination with appgroup.

Such as:

rule1) Deny appgroup(youtube)

rule2) Allow appfilter(category:video)

this would allow all flows identified as "video" except youtube (which is part of video).

Generally speaking when denying traffic the policy should be as broad as possible while allow traffic the policy should be as narrow as possible.

As a sidenote I would recommend you to avoid using "service:any" but rather "service:default-application" to not open up more ports than necessary. Because appid detection might in some situations take a few packets before the flow is properly identified.