Conversion of port numbers to Palo Alto App-id. How can I convert different Port numbers to App-id ? I was looking into Applipidia but could not find

[M.Ahmed043467]

I would like to know how to convert Port numbers into App-id in Palo Alto. I was trying to go to old Applipidia but it does not work. Could anyone tell me in new Applipidia how do I convert different port number to APP-ID

[Raido_Rattameister]

You can't.

Applications might have default port where they "usually" run on but you can't assume that 3389 is RDP as nothing stops me setting up SSH server on that same port.

Better to use application as this checks traffic pattern and signatures and not just a port number.

[A.Papaianus]

I would do like this:

1) Export logs for each site / fw/ cluster.

2) Check Application seen for each policy  - you can play in excel, create a helper column such as   =TEXTJOIN("-",Rule,  Application, Destination port) and remove duplicates

3) Create new policies and put them on top of the existing service port rules - pay attention that some AppID have prerequisites , for example if you add veeam you need to add net.tcp and ssl as well,  mssql-db-encrypted requires mssql-db-base .. 

4) reset counters and check usage before disabling any rule. 

Test test test everything, look for denied logs etc

Applipedia moved to a new version which requires authentication to see all the details https://applipedia.paloaltonetworks.com/ 

[OtakarKlier]

Hello,

If I understand your questions correctly, you would like to convert your Port based policies into using applications isntead. If yes then check our the Polciy Optimizer feature. It will tell you which applications are being seen. I would then recommend creatng a duplicate policy using the suggeted aplications and placing it above the current policy. Then just watch the last hit counter and modify the policy as needed.

https://docs.paloaltonetworks.com/strata-cloud-manager/getting-started/configuration-scm/security-po...

Regards,