How to allow unidentifed and insufficient-data application in the policy ?

Reply
mindterra
L2 Linker

How to allow unidentifed and insufficient-data application in the policy ?

Hi, I have some problem. As our design, we allow certain application in policies and deny all at the bottom. and we found that PAN device can't identify some app. so it is denied at the last rule.

How could we allow this unidentified app if we can't select this in application list?


Accepted Solutions
JRussell
L3 Networker

Well you could manually create an Application and base it on certain signature criteria. I have had to do this for certain Sharepoint sites to allow access to the files on there for my users. For that I based the signature on the sites HTTP-req-host-Header's and the ports it uses but you can base it on other things.

If you do that and then add your newly created application to your allow rule it should in theory work. But you might have to play around with how you identify the application until you find a signature that correctly identifies it for you.

View solution in original post


All Replies
JRussell
L3 Networker

Well you could manually create an Application and base it on certain signature criteria. I have had to do this for certain Sharepoint sites to allow access to the files on there for my users. For that I based the signature on the sites HTTP-req-host-Header's and the ports it uses but you can base it on other things.

If you do that and then add your newly created application to your allow rule it should in theory work. But you might have to play around with how you identify the application until you find a signature that correctly identifies it for you.

View solution in original post

mikand
L6 Presenter

Thats the proper way of handling this (create custom appid).

As a workaround you can also use application override and instruct PA that traffic from srcip/range to dstip/range on a specific port lets say TCP80 should be identified as "web-browsing" instead of unknown or whatever.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!