@TranceforLife_technically_ the security profiles would 'work' for an application override, but since there is no layer 7 inspection, they won't have any effect. it's like assigning security profiles to a deny policy (only it's being allowed). Just to confirm, given the fact we are using an Application override, means that technically not as secure for these ports since there is no App-ID associated with it, correct? @OMatlock I believe it's worse than that. You are assigning an app to it, so if someone were to send syslog over 7000 for example, it would become BroadVoice-SIP and be sent to the fastpath. So there's a trickle down effect in that logs would be incorrect, as an example, your security policies may not be applied appropriately depending on their order, etc. Absolutely the best course of action is always a custom app (without the override policy), but it's also the most challenging (but if it's already been done for you, then run with it). Actually the best course of action would be to submit a request to PA to create an app, but if it's inhouse or a standard app using non-standard ports, they won't be as inclined to to indulge the request.
... View more
