The App-ID technology in Palo Alto firewalls is designed to identify the applications running on your network, regardless of the port, protocol, or encryption being used. App-ID applies multiple classification mechanisms to the traffic, such as signatures, protocol decoding, and behavioral analysis, to ensure it accurately identifies applications. The idea is to enable or disable specific applications (or application features) for security or bandwidth management reasons rather than just opening or closing ports.
Here’s a detailed look at how App-ID works for the TCP handshake and data flow:
Phases of TCP and App-ID
1. TCP SYN: The client sends a TCP SYN packet to initiate a new connection.
2. TCP SYN-ACK: The server responds with a TCP SYN-ACK packet.
3. TCP ACK: The client returns an ACK to the server.
This completes the TCP three-way handshake, and the connection is established.
Where App-ID Fits
1. Pre-handshake Filtering: Before the handshake is completed, Palo Alto can perform some initial filtering based on source and destination IP, ports, and some other basic information. This initial classification is usually based on what is known as “port-based rules,” which can quickly filter out known malicious or unwanted ports.
2. Post-handshake, Pre-App-ID: Data starts to flow after the TCP handshake is complete. App-ID doesn’t usually fully identify applications during the handshake phase but waits for the actual application data to flow. Initial bytes of the application data are analyzed to determine the application.
3. App-ID Classification: App-ID performs deeper inspection as data starts flowing. This is where signatures, heuristics, and other identification mechanisms come into play. The first few packets of data are typically used to identify the application.
4. Ongoing Monitoring: Once an application is identified and the session is allowed to proceed, the firewall continues to monitor the session for any changes in the application or additional features or functions within the same application (known as “sub-applications” or “application functions”).
5. Content-ID and Threat Prevention: After App-ID has identified the application, other technologies like Content-ID can scan for viruses, spyware, data leakage, and more.
Timing
App-ID kicks in after the TCP handshake is complete and data starts flowing. However, it’s important to note that the initial classification and ongoing monitoring mean that App-ID is always at work, updating its context as more data is processed.
By waiting for the actual application data to flow, App-ID can accurately identify applications using dynamic ports, encryption, or other evasion techniques.
App-ID primarily identifies applications post-TCP handshake during the data transfer phase. However, based on more straightforward rule sets, basic filtering can occur before and during the handshake.
What To Do When App-ID Fails?
Reasons for “not-applicable”
If App-ID shows a status of “not-applicable,” it generally means that the firewall couldn’t identify the application for one of several reasons:
- Custom or Uncommon Applications: The application might be custom-built or not widely used.
- Evasive or Encrypted Traffic: Some applications might use encryption or other techniques to evade detection.
- Incomplete or Short-lived Sessions: App-ID might not have enough data to make a proper identification.
- Application Changes: Software updates can sometimes change application signatures, rendering them unrecognizable to older App-ID signatures.
- Network Issues: Packet loss or network latency could also affect App-ID’s effectiveness.
Troubleshooting Steps
- Traffic Logs and Packet Capture: Understand the type of traffic marked as “not-applicable” by capturing and analyzing packets.
- Create Custom App-IDs: For in-house or less common applications, create custom App-ID rules.
- Update App-ID Signatures: Regular updates can ensure that App-ID recognizes newly released or modified applications.
- Application Override Policies: Use this as a last resort to manually classify traffic, but exercise caution as it can introduce security risks.
- Check for SSL Decryption: If the traffic is encrypted, enabling SSL decryption might help App-ID identify the application.
- Consult Vendor Documentation or Support: Sometimes known issues might be documented, and vendor support can provide further guidance.
- Adjust Timeout Values: Modifying session timeouts can sometimes help App-ID in correctly identifying applications.
- Review Security Policies: Ensure that no security policy is causing the session to end prematurely, which could hinder App-ID’s ability to classify the application.
Conclusion
While App-ID is a robust and advanced technology, it may not always be perfect. It’s designed to be highly accurate, but some applications may pose challenges for various reasons, such as encryption, updates, or custom behaviors. In such cases, a thorough understanding of how App-ID works and an array of troubleshooting steps can help ensure your network remains secure and functional.
By maintaining a proactive approach—keeping the App-ID signatures updated, creating custom App-IDs when necessary, and understanding the nuances of the applications running on your network—you can make the most of what Palo Alto’s App-ID technology offers.