How work App-id when trafic is not inspected

Reply
L0 Member

How work App-id when trafic is not inspected

Good morning all,
I have a question regarding the relationship between Appid and Ssl Decryption. How can the Fw recognize an application when the traffic is not inspected?
Example user request https://www.youtube.com/watch?v=2zB2jiCxxuQ. What is the Fw going to see? The source ip, the destination ip for www.youtube.com 142.250.74.238 the Fqdn www.youtube.com and the certificate presented by the server which in our case is a multi san
* .google.com, *. android.com, *. appengine.google.com, source.android.google.cn, urchin.com, www.goo.gl, youtu.be, youtube.com, youtubeeducation.com, youtubekids.com, yt.be and many more ...

In this case for me application recognition can only be based on FQDN and SANs is this correct? In this case App-id will be in "best effort" because it will not be able to recognize the signature of the application since the traffic is not inspected.
If my analysis is correct, does it really make sense to use App-Id in the rules when traffic is not inspected?

 

For exemple for Starleaf traking
( port.dst eq 24704 ) and ( addr.dst in 88.84.147.242 )
Traffic To 88.84.147.242 is not decrypt du to exclusion
Recognized apps are
unknown-udp Drop
starleaf allow
insufficient-data allow

 

L7 Applicator

the SNI is also used to help identify YouTube if you do not have ssl decryption enabled

 

unknown-udp would not be normally encrypted data and insufficient data mans there will probably only be 4 or 5 packets echsnged with no usable data to identify an application, you could set up a packetcapture to verify what this could be and either create a custom application, or submit the data to Palo Alto so the signature can be improved

 

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!