How to disable App-ID for all applications

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

How to disable App-ID for all applications

Hello,

I've got two VWIRE pairs that see some duplicate traffic. 

Basically:

VWIRE1 sees LAN to Internet

VWIRE2 sees LAN+DMZ to Internet.

What I'd like to do to free up some resources is disable inspection on one of those pairs for traffic when source IP matches a CIDR block.  Creating a custom application doesn't work in this case.

Has anyone been able to do this?

thank you!

Andrew

Highlighted
L4 Transporter

Andrew,

Here is the link to disable application inspection on the firewall for certain traffic.

https://live.paloaltonetworks.com/docs/DOC-2816

Create two custom applications under Objects>Applications

1 )  For tcp port,  select under port :- tcp/dynamic

2) For UDP, select under port :udp/dynamic

Create two separate application override rules , one of tcp and the other for udp traffic.

One security rue will have protocol TCP  and ports 0-65535

The other security rule will have protocol UDP and port 0-65535

Let me know if this helps.

Regards

Highlighted
L4 Transporter

Hi Andrew,

You should be able to use an application override policy with a custom application.  The application override policy can be defined for a particular source or destination IP range/subnet.  Any session which matches the app override policy will be classified as the custom application.  This will also disable all layer 7 inspection on that traffic.

The document below gives further details.

https://live.paloaltonetworks.com/docs/DOC-1071

Thanks,

-- Kevin

Highlighted
L4 Transporter

Andrew,

Once you create the application over ride rule along with the custom application and commit, you need to clear all the existing sessions from the firewall that uses inbuilt application

>clear session all

OR

>clear session all filter source <x.x.x.x>

Now test the application override rule by sending traffic.

Regards

Parth

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!