How Palo alto APP ID functions to identify applications when it receives encrypted traffic ?

[perumalj]

I would like to know how APP ID works when Palo alto firewall receives encrypted traffic but no ssl decryption is enabled. 

[BPry · Accepted solution]

@perumalj,

The firewall still has limited insight into traffic even when you don't decrypt it. The accuracy of app-id goes down as we don't have full insight into the traffic, but that doesn't mean you can't identify some base IDs. Facebook and Google are prime examples of this; they'll show up as facebook-base and google-base even if you aren't decrypting the traffic, because you can still gather limited insight into where that traffic is going. 

So in short, the firewall still has limited insight into encrypted traffic and will do its best to identify that traffic appropriately. 

[aleksandar.astardzhiev · Accepted solution]

Hey @perumalj,

Probably the most common example for insight that @BPry has explained is the SNI (server name indicator) in SSL/TLS negotiation.