How Palo alto APP ID functions to identify applications when it receives encrypted traffic ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

How Palo alto APP ID functions to identify applications when it receives encrypted traffic ?

L2 Linker

I would like to know how APP ID works when Palo alto firewall receives encrypted traffic but no ssl decryption is enabled. 

 

 

2 accepted solutions

Accepted Solutions

Cyber Elite
Cyber Elite

@perumalj,

The firewall still has limited insight into traffic even when you don't decrypt it. The accuracy of app-id goes down as we don't have full insight into the traffic, but that doesn't mean you can't identify some base IDs. Facebook and Google are prime examples of this; they'll show up as facebook-base and google-base even if you aren't decrypting the traffic, because you can still gather limited insight into where that traffic is going. 

 

So in short, the firewall still has limited insight into encrypted traffic and will do its best to identify that traffic appropriately. 

View solution in original post

Hey @perumalj,

Probably the most common example for insight that @BPry has explained is the SNI (server name indicator) in SSL/TLS negotiation.

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

@perumalj,

The firewall still has limited insight into traffic even when you don't decrypt it. The accuracy of app-id goes down as we don't have full insight into the traffic, but that doesn't mean you can't identify some base IDs. Facebook and Google are prime examples of this; they'll show up as facebook-base and google-base even if you aren't decrypting the traffic, because you can still gather limited insight into where that traffic is going. 

 

So in short, the firewall still has limited insight into encrypted traffic and will do its best to identify that traffic appropriately. 

Hey @perumalj,

Probably the most common example for insight that @BPry has explained is the SNI (server name indicator) in SSL/TLS negotiation.

  • 2 accepted solutions
  • 2212 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!