Good morning all,
I have a question regarding the relationship between Appid and Ssl Decryption. How can the Fw recognize an application when the traffic is not inspected?
Example user request https://www.youtube.com/watch?v=2zB2jiCxxuQ. What is the Fw going to see? The source ip, the destination ip for www.youtube.com 18.104.22.168 the Fqdn www.youtube.com and the certificate presented by the server which in our case is a multi san
* .google.com, *. android.com, *. appengine.google.com, source.android.google.cn, urchin.com, www.goo.gl, youtu.be, youtube.com, youtubeeducation.com, youtubekids.com, yt.be and many more ...
In this case for me application recognition can only be based on FQDN and SANs is this correct? In this case App-id will be in "best effort" because it will not be able to recognize the signature of the application since the traffic is not inspected.
If my analysis is correct, does it really make sense to use App-Id in the rules when traffic is not inspected?
For exemple for Starleaf traking
( port.dst eq 24704 ) and ( addr.dst in 22.214.171.124 )
Traffic To 126.96.36.199 is not decrypt du to exclusion
Recognized apps are
the SNI is also used to help identify YouTube if you do not have ssl decryption enabled
unknown-udp would not be normally encrypted data and insufficient data mans there will probably only be 4 or 5 packets echsnged with no usable data to identify an application, you could set up a packetcapture to verify what this could be and either create a custom application, or submit the data to Palo Alto so the signature can be improved
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!