Undetected APP dependency?

[B.Porcelli]

Hi. So we ran into an issue and we're not sure if there's a missing app dependency in the Palo Alto db or if we're missing something.

What happened was, we migrated one Policy from port to APP-based. On the Apps seen it only had one detected app (let's call it app1) with no new apps seen for a long time. This rule is being hit regularly by traffic, but when we migrate to APP using Match usage option, we found denied traffic from another app (let's call it app2) that was never seen and that seems to be needed. When we added to the rules, the program worked. But even after that, we still can't see that app2 present in the traffic.

So we allowed log at the session start and what we can see is that the session starts with both apps detected at the beginning of the session and then it ends (quite some time later) only with the app1. 

So what we want to know is if there's any chance that Palo Alto is tagging the traffic with both apps at the begging of the session, and then mid session the traffic tag/indentification it's changed to app1, an ends up being cataloged as that. It's like the app2 traffic is so short it never sees it in the session and the app1 overrides it somehow. Shouldn't this be reported as an undetected APP dependency?

We would appreciate some insight, although I realise I have made a mess trying to explain it. Sorry and thanks!

[BPry · Accepted solution]

@B.Porcelli,

Not sure why you're not stating the actual app-ids causing you issues, but yes this is something that can happen. Sometimes its simply that the firewall does not follow the "implicitly uses" aspect of the signature and other times it just improperly identifies the application early on in the session and then transitions to the proper signature as it processes more traffic. As an example, you'll see this with ms-rdp and cotp/t.120 pretty often.

I've never really gotten a satisfactory answer as to why this happens honestly. It's a simple enough thing to address from a policy aspect and once something is functional it's often difficult to get TAC to answer the why behind something and you're stuck looking for the answer yourself. 

Since you aren't actually naming the app-ids that you're seeing and running into an issue with, I'm not sure if you're noticing an "implicitly uses" issue as noted above or something else. Since it's unlikely that you're talking about custom signatures (and even then it's just an application name) it could be helpful if you included the signatures that you're running into an issue with. 

[B.Porcelli]

Thanks for your quick response, BPry! I’m not stating the apps for security reasons (I know, probably overkill). But now that you mention it, I’ve already seen the ms-rdp cotp/t.120 issue and assumed this was something like that.

I don’t think this case is related to an issue with the “implicitly uses” function, as the apps are not listed here and are very specific (not custom, though). 

I will reconsider opening a TAC case, as you mentioned I might not get any response at all.  
Thanks again for the help!