Custom App-ID vs "Unknown-UDP"

[DPoppleton]

If I create a custom app-id for an application we use, will it no longer match the "unknown-udp" (which we block)? Or do I need to do an application override as well?

[TranceforLife]

If you create a custom app and your traffic matching your NEW application then no need to override it. APP Override as easy as I can explain is inspection up to layer 4 (TCP/UDP ports). After traffic is hitting correct port your app is identified so no  other checks applies by app id if that makes sense :0

[DPoppleton]

Thank you, that is the best explanation I've seen and I have been searching around for a while!

I'll give the new App-ID a try.

[TranceforLife]

The video below will help you to create a custom app:

https://www.youtube.com/watch?v=CwXdWJpw0UY

If the custom app (on its own) wouldn't work when add a app override policy so app id  inspection will be only up to layer 4.

[reaper]

please check this article also: Getting Started: Custom applications and app override

If you are able to add any sort of signature to help identify your session, the custom app will function like any other application AppID can identify

if this is not possible, an app override may be required to force the app to be identified as your custom app (but this will restrict content scanning)

[DPoppleton]

I have a 24 byte string the client always sends to open the communication. I have created a custom app-id, but the user is out until next week so I have to wait to see if it works.

[DPoppleton]

I've given up on the app id.. from what I have read in the documentation the 24-byte string in the beginning of the communication isn;t enough. I had to do an "unknown-req-udp-payload" context. To use that you have to use the full payload to match, but the full packet isn't always the same.

So off to override land I go.