Identifying Applications

[Jack_Howells]

Hi guys,

Got an odd one here. Traffic is being identified as a completely different application to what the traffic actually is. For example, see below.

I've cleared the dataplane cache and re-downloaded the DB categorisation as per the document below, but to no avail.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Handle-a-URL-Miscategorization/ta-p/...

Anyone experienced this before? Device is running 7.1.2 and apps and threats are up to date.

Cheers

Jack

[pankaku]

what do you see when you run the command

test url <URL>

[pankaku]

You can also try:

debug dataplane reset appid cache

[Jack_Howells]

Hi Pankaj,

Thanks for your reponse.

I have tried all of this to no avail. It looks like a buggy app-id engine.

If I apply the URL filtering profile to the policy the issue occurs, however if there isn't a URL filtering profile, and I check the traffic logs, the application is identified correctly.

This case is being escalated to a higher tier for now. Just in case anyone experiences the same issue, I will update this as the case progresses and interesting information comes in.

Cheers

Jack