10-13-2016 08:05 AM
How app-ID identify encrypted application. Suppose I have allowed only facebook-base in policy and there is not decryption policy.
10-13-2016 11:19 AM - edited 10-13-2016 12:15 PM
When you visit SSL site then firewall sees certificate.
If you go to www.facebook.com then there is just Facebook and app is identified as facebook-base.
If you go to any Google service (maps.google.com, www.gmail.com etc) then cert says *.google.com and firewall is unable to identify exact application and uses broad google-base as application.
If there is no application for specific site then traffic is just identified as SSL.
If you have decryption policy in place then firewall can also detect subapplications like facebook-apps, facebook-chat etc
10-13-2016 08:16 AM
It will attempt to identify the traffic by the packet header; if it can't then the rule won't work. In practice it's a hit and miss thing with encrypted traffic, even if a rule using app-id generally works you will run into instances where it doesn't because it doesn't properly match what that app-id signature is looking for.
10-13-2016 11:19 AM - edited 10-13-2016 12:15 PM
When you visit SSL site then firewall sees certificate.
If you go to www.facebook.com then there is just Facebook and app is identified as facebook-base.
If you go to any Google service (maps.google.com, www.gmail.com etc) then cert says *.google.com and firewall is unable to identify exact application and uses broad google-base as application.
If there is no application for specific site then traffic is just identified as SSL.
If you have decryption policy in place then firewall can also detect subapplications like facebook-apps, facebook-chat etc
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
