IDENTIFY AND CONTROL APPLICATIONS

App-ID
• Application identification (App-ID) overview
• Using App-ID in a Security policy
• Identifying unknown application traffic
• Migrating to an App-ID-based Security policy
• Updating App-ID
EDU-210 Version A
PAN-OS® 9.0
Agenda
After you complete this module,
you should be able to:

• Define application identification

• Describe the four major technologies to help identify applications
• Configure application filters and application groups
• Detect unidentified applications traversing the firewall
• Migrate a port-based rule to an App-ID based rule
• Configure scheduling of updates to App-ID

2 | © 2019 Palo Alto Networks, Inc.

Flow Logic of the Next-Generation Firewall
Session Setup
Does
traffic match Zone Forwarding Destination Security
Source Assign
to an existing No and/or DoS Lookup Zone Policy Check
Zone Session ID
session? Protection (PBF) (plus DNAT (App-ID
check) ignored)

Yes

Inspection and Enforcement

App-ID Encrypted? Security Policy*

Forward
INSPECTION Yes No ENFORCEMENT Traffic
Decrypt
Content-ID Policy? Security Profiles
Yes (Re-encrypt if decrypted)

* Policy check relies on pre-NAT IP addresses

3 | © 2019 Palo Alto Networks, Inc.
Application identification (App-ID) overview

Using App-ID in a Security policy

Identifying unknown application traffic

Migrating to an App-ID-based Security policy

Updating App-ID
What Is an Application?

• An application is a specific
program or feature whose Gmail
communication can be Google Hangouts
labeled, monitored, and
Google Calendar
controlled.

Microsoft SQL

Skype

BitTorrent

5 | © 2019 Palo Alto Networks, Inc.

What Is App-ID?
• Multiple techniques to label traffic by application rather than just port

Port-based security rule

Application-based security rule

6 | © 2019 Palo Alto Networks, Inc.

Port-Based Versus Next-Generation Firewalls

Traditional Firewalls Palo Alto Networks Firewalls with App-ID

Firewall Rule: ALLOW Port 53 Firewall Rule: ALLOW DNS

DNS
✔ DNS DNS
✔ DNS

Firewall Firewall
Port 53 Port 53
BitTorrent
✔ BitTorrent BitTorrent
✗
Packet on port 53: Allow DNS = DNS: Allow
Packet on port 53: Allow BitTorrent ≠ DNS: Deny
Visibility: Port 53 allowed Visibility: BitTorrent detected and
blocked
7 | © 2019 Palo Alto Networks, Inc.
Zero-Day Malware: IPS Versus App-ID

Legacy Firewalls Palo Alto Networks Firewall with App-ID

Firewall Rule: ALLOW Port 53 Firewall Rule: ALLOW DNS
Application IPS Rule: Block BitTorrent

Firewall App IPS Firewall

DNS
✔ DNS
✔ DNS DNS
✔ DNS

BitTorrent
✔ BitTorrent
✗ BitTorrent
✗
✗
Zero-day
✔
Zero-day Zero-day Zero-
C2 C2 ✔ day C2 C2

Packet on port 53: Allow DNS = DNS: Allow

C2 ≠ BitTorrent: Allow C2 ≠ DNS: Deny
Visibility: Packet on port 53 allowed Visibility: Unknown traffic detected
and blocked
8 | © 2019 Palo Alto Networks, Inc.
App-ID and UDP
Lightweight UDP Packet The first UDP packet

Src address and Dst address

Src port and Dst port

Application data

9 | © 2019 Palo Alto Networks, Inc.

App-ID and TCP
SYN
 Src address and Dst address
ACK
SYN,  Src port and Dst port
Client Server

Example ACK
of an
GET
HTTP
web TCP Packet
request
D ata 11
t i on 1110 01
a 1 1
p plic 1000 0011
A 10 11
0
0 0 1 1000
0 1 Application data
0 10
1

10 | © 2019 Palo Alto Networks, Inc.

App-ID Operation
Start
App-ID
Extract Unknown
IP/port protocol
Allowed
decoder

Check
Y Known Check
Security Traffic Application
protocol Security
policy allowed? signature
decoder policy
(app=any)

Decrypt per N Blocked

decryption
policy?
Y
Decrypt

11 | © 2019 Palo Alto Networks, Inc.

Application identification (App-ID) overview

Using App-ID in a Security policy

Identifying unknown application traffic

Migrating to an App-ID-based Security policy

Updating App-ID
Application Shifts
• Network traffic can shift from one application to another during a session.

Web server shift shift shift

web-browsing SSL facebook-base facebook-chat

syn syn ack HTTP GET

/ack
Web client

13 | © 2019 Palo Alto Networks, Inc.

Dependent Applications

http://login.microsoftonline.com
Joe Destination Port: TCP 80
1. HTTP GET = web-browsing
192.168.15.22 74.125.224.64
Zone: Inside Zone: Outside
2. Request specifically Office on Demand

office-on-demand Application shift

dependent on
ms-office365-base and
sharepoint-online

14 | © 2019 Palo Alto Networks, Inc.

 Determining Application Dependencies

Objects > Applications

• Dependent applications require you to

add a Security policy rule.
15 | © 2019 Palo Alto Networks, Inc.
Implicit Applications
• Many common applications implicitly allow parent applications.
• No explicit Security policy rule is required for a parent application.

facebook-base implicitly
allows web-browsing
and SSL

16 | © 2019 Palo Alto Networks, Inc.

 Determining Implicitly Used Applications

Objects > Applications

17 | © 2019 Palo Alto Networks, Inc.

 Application Filter
Objects > Application Filter > Add

• Dynamic grouping of
applications
• Created by selecting
filters in the App-ID
database
• Used to simplify
Security, QoS, and
PBF policy rulebases

18 | © 2019 Palo Alto Networks, Inc.

Application Groups

Objects > Application Groups > Add

• Static, administrator-
defined sets of applications

• Used to simplify Security

and QoS policy rulebases

19 | © 2019 Palo Alto Networks, Inc.

Nesting Application Groups and Filters

Security Policy

20 | © 2019 Palo Alto Networks, Inc.

 Applications and Security Policy Rules

Application Application
Policies > Security Filter Group

Application

21 | © 2019 Palo Alto Networks, Inc.

Creating and Using Custom Services

Objects > Services

Policies > Security

22 | © 2019 Palo Alto Networks, Inc.

Application Block Page
• For blocked web-based applications, a response page can be displayed in the
user’s browser.

Device > Response Pages

23 | © 2019 Palo Alto Networks, Inc.

Application identification (App-ID) overview

Using App-ID in a Security policy

Identifying unknown application traffic

Migrating to an App-ID-based Security policy

Updating App-ID
Unknown Network Traffic

Check
ftp, smtp, web-
Identifiable by Traffic log
browsing
App-ID
etc.

Allowed
network traffic unknown-tcp
No unknown-udp

Unidentifiable HTTP
by App-ID detected?

Yes
web-browsing

25 | © 2019 Palo Alto Networks, Inc.

 Identify Unknown Application Traffic

Iterative process:
• Create rules to allow or block applications known to be traversing the firewall
• Create a temporary rule to detect unidentified applications traversing the firewall
• As applications are identified, create specific rules to allow or block them

Policies > Security

Monitor > Logs > Traffic to see application identification

26 | © 2019 Palo Alto Networks, Inc.

Controlling Unknown Applications

unknown-tcp
unknown-udp
web-browsing

Create a custom Configure an

application with a Application Override *Block unknown-tcp,
custom signature policy unknown-udp in a
Objects > Applications Policies > Application security rule
> Add Override

*Could block more traffic than intended

27 | © 2019 Palo Alto Networks, Inc.

Application identification (App-ID) overview

Using App-ID in a Security policy

Identifying unknown application traffic

Migrating to an App-ID-based Security policy

Updating App-ID
 Policy Optimizer

• Migrate port-based rules to App-ID-based rules

• Help reduce attack surface and provide information about application usage
• Prevent evasive applications from running on non-standard ports
• Identify over-provisioned application-based rules

Policies > Security > Policy Optimizer > No App Specified

29 | © 2019 Palo Alto Networks, Inc.

Moving to Application-Based Policies

Phase 1 Phase 2 Phase 3

Identify legacy Add application- Remove port-

port-based policy based rules above based rules
rules corresponding
port-based rules

30 | © 2019 Palo Alto Networks, Inc.

Phase 1: Viewing Data of Port-Based Rules
Use No App Specified to discover port-based rules.

Policies > Security

Application “any” triggers

No App Specified match
Policies > Security > Policy Optimizer > No App
Specified

31 | © 2019 Palo Alto Networks, Inc.

Discovering Applications Matching a Port-Based Rule
Policies > Security > Policy Optimizer > No App Specified

• Click App Seen number or Compare to

view any applications that matched the
port-based rule.
• The firewall displays a list of applications
seen and identified by a rule. Three options to
convert the rule
• Use applications listed to create
application-based rule(s).

32 | © 2019 Palo Alto Networks, Inc.

Phase 2: Cloning a Port-Based Rule Using “Create Cloned Rule”
Option 1 of 3:
• Clones port-based rule to new
application-based rule

• Safest method when many

applications permitted by a
rule

• Lists and prompts for required

application dependencies
1. Select application(s).
2. Click Create Cloned Rule.
3. Name new rule.

33 | © 2019 Palo Alto Networks, Inc.

Result of Using “Create Cloned Rule”

The ftp application is removed from

the port-based rule Apps Seen list
and placed in a new rule.

Policies > Security Must manually configure

as application-default

34 | © 2019 Palo Alto Networks, Inc.

Replacing a Port-Based Rule Using “Add to Rule”

Option 2 of 3:
• Firewall replaces port-
based rule with
application-based rule.
• Moves selected
applications to a new rule
• Lists and prompts for
required application
1. Select application(s).
dependencies
2. Click Add to Rule.
• Riskier method because
some required
applications could be
inadvertently missed.

35 | © 2019 Palo Alto Networks, Inc.

Result of Using “Add to Rule”

The web-browsing application is added

to the left-side Applications column.

Policies > Security Must manually configure

as application-default

New application-based rule

replaces port-based rule.
36 | © 2019 Palo Alto Networks, Inc.
Replacing a Port-Based Rule Using “Match Usage”
Option 3 of 3:
• Use only when the rule
matches a small number
of legitimate applications.
• Copies all applications
under Apps Seen to
Apps on Rule
• Firewall replaces port-
Click Match Usage based rule with
application-based rule.

37 | © 2019 Palo Alto Networks, Inc.

Result of Using “Match Usage”

All applications are added to the

left-side Apps on Rule column.

Must manually configure

as application-default
Policies > Security

New application-based rule

replaces port-based rule.
38 | © 2019 Palo Alto Networks, Inc.
Prioritizing Port-Based Rules to Convert
Prioritize rules Prioritize rules with Prioritize rules that
passing more data more applications are more stable

Prioritize rules that

match more sessions

39 | © 2019 Palo Alto Networks, Inc.

Phase 3: Reviewing Port-Based Rules

• After 60 days, review the Policy Optimizer columns in the Security policy.
• Look for port-based rules with zero hits.

Policies > Security

40 | © 2019 Palo Alto Networks, Inc.

Disabling Port-Based Rules

Policies > Security

• Disable port-based rules that have not matched to any new traffic.
• Disabled rules are rendered in gray italic font.
• Tag rules that must be removed later (optional).

41 | © 2019 Palo Alto Networks, Inc.

Removing Port-Based Rules
• After 90 days, delete port-based rules that have not matched to any new traffic.
• The goals:
• At least 80% application-based rules
• No inbound or outbound unknown applications (internal is acceptable)
Policies > Security

42 | © 2019 Palo Alto Networks, Inc.

Application identification (App-ID) overview

Using App-ID in a Security policy

Identifying unknown application traffic

Migrating to an App-ID-based Security policy

Updating App-ID
Dynamic Content Updates: App-ID

Palo Alto
Networks
new_app
Choices:
• Scheduled download
App-ID Monthly only
updates • Scheduled download
DB
and install
• Manual download and
new_app install

44 | © 2019 Palo Alto Networks, Inc.

 Scheduled App-ID Updates
Device > Dynamic Updates

Click to schedule
updates.
If selected, new
application signatures
are disabled.

45 | © 2019 Palo Alto Networks, Inc.

Content Update Absorption

• Review Apps for list of modified applications and details for each application
• Review Policies to see policy rules that may enforce traffic differently
Device > Dynamic Updates

If necessary, modify
Used to for your environment.
determine risk

Based on
characteristics New data for
software as a
service

46 | © 2019 Palo Alto Networks, Inc.

Pre-Analyze New Application and Policy Interaction

Objects > Applications

Select and enable Click to preview new

or disabled application signature and
application(s). policy interaction.

47 | © 2019 Palo Alto Networks, Inc.

Review Policies
• View which policy rules will match new applications

Objects > Applications > Review Policies

48 | © 2019 Palo Alto Networks, Inc.

Module Summary
Now that you have completed this module,
you should be able to:

• Define application identification

• Describe the four major technologies to help identify applications
• Configure application filters and application groups
• Detect unidentified applications traversing the firewall
• Migrate a port-based rule to an App-ID based rule
• Configure scheduling of updates to App-ID

49 | © 2019 Palo Alto Networks, Inc.

Questions?

Q &&
A
50 | © 2019 Palo Alto Networks, Inc.
App-ID Lab (Pages 65-89 in the Lab Guide)
• Load a firewall lab configuration
• Create an application-based firewall rule
• Enable the Application Block Page
• View the Traffic log for application information

51 | © 2019 Palo Alto Networks, Inc.

PROTECTION. DELIVERED.