Vulnerability Protection profile alters APP-ID behavior

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Vulnerability Protection profile alters APP-ID behavior

L3 Networker

Hello everybody,


  while writing some articles on our company wiki, I found a strange behavior of the firewall. This is my environment:


PA model: PA-820

PAN-OS version: 10.1.8

APP/Threat version: 8653-7756

Decryption: SSL inbound enabled


I have a policy that allows access to the wiki with applications ssl and web-browsing. When no vulnerability protection profile is applied, I can access all pages of the wiki without any problem. The applications seen are, obviously, only ssl and web-browsing.


If I apply the provided strict vulnerability protection profile, accessing a particular wiki page is denied. The cause is that, when accessing that page, the application is identified as apache-guacamole instead of web-browsing. The wiki page is about installing and configuring Apache Guacamole, but it's not the Guacamole web UI. In the threat log there are no events about any threat detected. If I access the same page in edit mode, the page is not blocked.


These are the URLs involved:


  • https://my company domain/it/knowledge-base/guacamole/setup (this is blocked when the vulnerability protection profile is applied, app-id sees "apache-guacamole" application instead of web-browsing)
  • https://my company domain/e/it/knowledge-base/guacamole/setup (never blocked)


Any idea about the cause of this behavior? It seems to me that the vulnerability protection feature is confusing the APP-ID engine.


Cyber Elite
Cyber Elite


If you have an account team, I would pass this on to them and have them push it through internal channels. I don't know how well pushing something like this through TAC would actually work. 

TAC says it's an expected behavior because, when applying security profiles, the Content-ID inspection looks at the content of the file/webpage and this can cause an application shift. The solution is to allow those applications on the security policy. This can make sense, but it's not very nice to allow an additional application where it's not actually in use.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!