In case of any UDP based Application traffic, The PAN firewall will allow few packets in each direction ( Client-Server and Server-Client) to identify/match the application signature App-ID. Ideally, it will be minimum 4 packets or 2000 bytes. Till that time, the PAN will identify that traffic as "Unknown-UDP" and allow it through. As soon as the application identified by PAN FW,the appropriate policy/rule will be applied to that traffic.
Hope this helps.
When UDP packets hit firewall, firewall allows initial few UDP Packets. After that it may determine application based on packet content.
Sometimes, firewall is not able to determine application because packets doesn't match existing decoder.
In such scenario firewall identifies stream as "unknown-udp".
You dont need to allow "unknown-udp" for any UDP traffic.
Question to your answer is Yes. If you don't have a policy that is not denying "unknown-udp" application, firewall will allow it. In Monitor tab, you will source and destination address and application as "Unknown-UDP". It simply means firewall did not have signature for the packets it was seeing. You can also deny it by denying "unknown-udp" in security policy but is however configurable and is based on your requirement. Hope that helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!