How App-ID identify encrypted application

cancel
Showing results for 
Search instead for 
Did you mean: 

How App-ID identify encrypted application

L0 Member

How app-ID identify encrypted application. Suppose I have allowed only facebook-base in policy and there is not decryption policy.

1 ACCEPTED SOLUTION

Accepted Solutions

When you visit SSL site then firewall sees certificate.

If you go to www.facebook.com then there is just Facebook and app is identified as facebook-base.

If you go to any Google service (maps.google.com, www.gmail.com etc) then cert says *.google.com and firewall is unable to identify exact application and uses broad google-base as application.

If there is no application for specific site then traffic is just identified as SSL.

 

If you have decryption policy in place then firewall can also detect subapplications like facebook-apps, facebook-chat etc

Enterprise Architect, Security @ Cloud Carib Ltd
ACE, PCNSE, PCNSI

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

It will attempt to identify the traffic by the packet header; if it can't then the rule won't work. In practice it's a hit and miss thing with encrypted traffic, even if a rule using app-id generally works you will run into instances where it doesn't because it doesn't properly match what that app-id signature is looking for. 

When you visit SSL site then firewall sees certificate.

If you go to www.facebook.com then there is just Facebook and app is identified as facebook-base.

If you go to any Google service (maps.google.com, www.gmail.com etc) then cert says *.google.com and firewall is unable to identify exact application and uses broad google-base as application.

If there is no application for specific site then traffic is just identified as SSL.

 

If you have decryption policy in place then firewall can also detect subapplications like facebook-apps, facebook-chat etc

Enterprise Architect, Security @ Cloud Carib Ltd
ACE, PCNSE, PCNSI
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!