4
application identification
Firewall has the ability to identify an application via network traffic.
⭐ Implement policy by application rather than by port
App-ID reduces the attack surface
App-ID
Enables you to see applications on network and learn how they work
Identified using protocol, bit pattern, behavioral heuristics
Port Based Versus Next Gen Firewalls
Next Gen Firewall - if not specified application, traffic will not pass.
Classifying TCP Traffic
From SYN, obtain the source and destination addresses and ports
Application data is retrieved from either the client's HTTP GET request or in the server's reply to detect more information about the App-ID
not-applicable
Firewall discards traffic because Security policy does not allow it
incomplete
TCP Handshake does not complete / No data follows after the handshake
insufficient-data
Not enough data is received in payload to identify application
unknown-tcp
App-ID cannot identify application after the three-way TCP handshake
unknown-p2p
App-Id cannot match traffic to a specific application, but traffic exhibits generic peer-to-peer behavior
Classifying UDP Traffic
Usually, only the first UDP packets are examined as it inlcudes not only the source, destination ports and address, but also the application data, which will be used to identify the traffic to be processed by the Security policy.
not-applicable
Firewall discards the traffic becasue Security policy does not allow it
unknown-udp
App-ID cannot identify the application
unknown-p2p
App-ID cannot match the UDP traffic to a specific application
App-ID concepts and operation
Application Shifts - Network traffic can shift from one application to another during the lifetime of a session, becoming even more classified. (eg. web-browsing -> generic-application -> generic-application-chat)
Application Dependencies
When applications have several dependencies, the network traffic can shift from one application to another during the lifetime of the session.
As such, policies to allow an application's dependencies are also needed, apart from the current application being used.
Unknown and encrypted application traffic
For processing traffic that are unknown applications, there are three methods:
Block unknown-tcp, unknown-udp, or unknown-p2p traffic in Security policy
❌Block more traffic than you intend (eg. internally developed application
Create a custom application rather than block unknown traffic
Configure an Application Override policy rule
Application Override policy rule can be used to identify traffic for application based on its source zone, IP address, destination zone, port and protocol.
Sometimes, the application layer data is encrypted.
App-ID can identify SSL/TLS traffic, and the firewall can be configured to deccrypt teh SSL/TLS traffic to identify the application via signatures, decoders, behvaioural heuristics
Updating App-ID
Scheduling of regular downloads and installation of new content updates should be done to maintain the most current protection level possible
Last updated