12-03-2020 02:34 AM
Good morning all,
I have a question regarding the relationship between Appid and Ssl Decryption. How can the Fw recognize an application when the traffic is not inspected?
Example user request https://www.youtube.com/watch?v=2zB2jiCxxuQ. What is the Fw going to see? The source ip, the destination ip for www.youtube.com 142.250.74.238 the Fqdn www.youtube.com and the certificate presented by the server which in our case is a multi san
* .google.com, *. android.com, *. appengine.google.com, source.android.google.cn, urchin.com, www.goo.gl, youtu.be, youtube.com, youtubeeducation.com, youtubekids.com, yt.be and many more ...
In this case for me application recognition can only be based on FQDN and SANs is this correct? In this case App-id will be in "best effort" because it will not be able to recognize the signature of the application since the traffic is not inspected.
If my analysis is correct, does it really make sense to use App-Id in the rules when traffic is not inspected?
For exemple for Starleaf traking
( port.dst eq 24704 ) and ( addr.dst in 88.84.147.242 )
Traffic To 88.84.147.242 is not decrypt du to exclusion
Recognized apps are
unknown-udp Drop
starleaf allow
insufficient-data allow
