Does "Unknown-udp" app allow any UDP Packets?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Does "Unknown-udp" app allow any UDP Packets?

L2 Linker

Does "Unknown-udp" Appl. allow any UDP Packets?

I did not find any app and would like to allow UDP only.



L4 Transporter

The app-id "unknown-udp" can be used to allow/block UDP traffic that did not match any other application signature. That does not mean all UDP traffic.

If you want to allow all UDP traffic,you should create a service object containing the port range 1-65535.

L7 Applicator

Hello Roman,

In case of any UDP based Application traffic, The PAN firewall will allow few packets in each direction ( Client-Server and Server-Client) to identify/match the application signature App-ID. Ideally, it will be minimum 4 packets or 2000 bytes. Till that time, the PAN will identify that traffic as "Unknown-UDP" and allow it through. As soon as the application identified by PAN FW,the  appropriate policy/rule will be applied to that traffic.

Reference DOC:

How to Verify the Application Name Change from Unknown-tcp/udp to Actual App-ID


Hope this helps.


L7 Applicator

Hello Roman,

As torm said, if you want to allow all UDP traffic, you may create a custom service profile and allow all applications in a "security Rule".

NOTE: UDP is not an application, it's a Transport layer protocol used to application traffic. Smiley Happy



Hope this helps.


L6 Presenter


When UDP packets hit firewall, firewall allows initial few UDP Packets. After that it may determine application based on packet content.

Sometimes, firewall is not able to determine application because packets doesn't match existing decoder.

In such scenario firewall identifies stream as "unknown-udp".

You dont need to allow "unknown-udp" for any UDP traffic.


Hardik Shah

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!