hi @clyde.franklin
App-ID works slightly different
each appliucation does have a default port, but app-id will work across all ports : if you open a webserver's port 15999 for example app-id will identify web-browsing because it sees the http GET
the port associated to web-browsing will only be detrimental when your security policy has 'application-default' in the security policy, which limits which ports are allowed by initial SYN packets
eg. if there is only 1 with web-browsing and DNS and service app-default, then the drop rule only SYN packets on ports 80, 8080 and 53 will be allowed
if the service for that rule is set to 'any', all ports will be allowed, but as soon as payload starts to flow and app-id is not able to match web-browsing or DNS the session will be discarded
there are also a few apps that are tcp/dynamic, which means they are supposed to use any random port
if you're migrating from a different platform a good method is, for any rules that have you wondering which apps are hit, to duplicate the policy and add the apps you know in the top rule, then run reports/show logs on the second rule to see which apps you've missed, then add them to the top rule till there are no more sessions hitting the second policy, or only unwanted apps hit it, then delete the rule
... View more