How to allow unidentifed and insufficient-data application in the policy ?

[mindterra]

Hi, I have some problem. As our design, we allow certain application in policies and deny all at the bottom. and we found that PAN device can't identify some app. so it is denied at the last rule.

How could we allow this unidentified app if we can't select this in application list?

[JRussell · Accepted solution]

Well you could manually create an Application and base it on certain signature criteria. I have had to do this for certain Sharepoint sites to allow access to the files on there for my users. For that I based the signature on the sites HTTP-req-host-Header's and the ports it uses but you can base it on other things.

If you do that and then add your newly created application to your allow rule it should in theory work. But you might have to play around with how you identify the application until you find a signature that correctly identifies it for you.

[mikand]

Thats the proper way of handling this (create custom appid).

As a workaround you can also use application override and instruct PA that traffic from srcip/range to dstip/range on a specific port lets say TCP80 should be identified as "web-browsing" instead of unknown or whatever.