How to disable App-ID for all applications

[abarnett]

Hello,

I've got two VWIRE pairs that see some duplicate traffic. 

Basically:

VWIRE1 sees LAN to Internet

VWIRE2 sees LAN+DMZ to Internet.

What I'd like to do to free up some resources is disable inspection on one of those pairs for traffic when source IP matches a CIDR block.  Creating a custom application doesn't work in this case.

Has anyone been able to do this?

thank you!

Andrew

[ppatel]

Andrew,

Here is the link to disable application inspection on the firewall for certain traffic.

https://live.paloaltonetworks.com/docs/DOC-2816

Create two custom applications under Objects>Applications

1 )  For tcp port,  select under port :- tcp/dynamic

2) For UDP, select under port :udp/dynamic

Create two separate application override rules , one of tcp and the other for udp traffic.

One security rue will have protocol TCP  and ports 0-65535

The other security rule will have protocol UDP and port 0-65535

Let me know if this helps.

Regards

[kfindlen]

Hi Andrew,

You should be able to use an application override policy with a custom application.  The application override policy can be defined for a particular source or destination IP range/subnet.  Any session which matches the app override policy will be classified as the custom application.  This will also disable all layer 7 inspection on that traffic.

The document below gives further details.

https://live.paloaltonetworks.com/docs/DOC-1071

Thanks,

-- Kevin

[ppatel]

Andrew,

Once you create the application over ride rule along with the custom application and commit, you need to clear all the existing sessions from the firewall that uses inbuilt application

>clear session all

OR

>clear session all filter source <x.x.x.x>

Now test the application override rule by sending traffic.

Regards

Parth