I am working with a client in an interesting situation.. We are basically needing to limit sections of the network where certain users and login to a web server. For example, only admins can login from zone1 and only users can login from zone2. The application on the web server is not a custom one built by the client but there is no current ID for it in the app-id db. Currently, we would like to make the policy decisions based on app.. and have a separate ID based on admins or users. I created an APP-ID for the application itself and tested it; it works! I also checked "Continue scanning for other applications". Next, I used a proxy to monitor the packets and found that the username is submitted via HTTP PARAMS. So, I cloned the original APP-ID and made a new one (we will call it App-User). I added an AND condition to the original signature and it looks for: Context: http-req-params pattern: user (I have also tried username=user). Qualifier is http method = POST. After committing this.. the PAN IDs the traffic as the original APP-ID but does NOT change the app identified once someone sends posts requests with the specific username identified. Will this not work in the manner I think it would? Any better suggestions? FWIW: I don't have to create an AND rule for each user. The user base all share a generic ID for this system.
... View more
