App-ID, core Palo Alto Networks firewalls capability was elaborated at high level perspective on below blog post:
Like mentioned above, all traffic flowing through the firewall is inspected by App-ID engine. Is NGFW able to identify every packets at layer 7? Of course not, what happening than and how knowledge about App-ID operations can be used for troubleshootong purposes.
App-ID and TCP
Applications that use TCP usually require multiple packet transfers to identify an application. This example shows an HTTP connection request. The first packet is a TCP SYN packet. Though the first packet does contain the source and destination addresses and ports, it includes no application data. The following two packets complete the required TCP three-way handshake and do not contain application data. The application data could reside in either the client’s HTTP GET request or the server’s reply. For this reason, the firewall might have to examine the fifth packet.
What happen when session is not established or there is no data? Firewall adds specific labels to traffic
- not-applicable – firewall discards it because the security policy does not allow it
- incomplete – three-way TCP handshake does not complete or when the handshake completes but no data follows the handshake
- insufficient-data – not enough data is received in the payload to identify the application. In this case, the three-way TCP handshake completes, but more information needs to follow the handshake to identify the traffic
- unknown-tcp – the three-way TCP handshake completes and data flows, but App-ID cannot identify the application
- unknown-p2p – same as unknown-tcp, but the traffic exhibits generic peer-to-peer behavior
App-ID and UDP
UDP is connection less, data can be sent with first packet, so all the information the firewall needs are contained in the first packet
App-ID labels the traffic as not-applicable when the firewall discards it because the security policy does not allow it. App-ID labels the traffic as unknown-udp/unknown-p2p when App-ID cannot identify the application.
App-ID labels and troubleshooting
Every Engineer responsible for networking infrastructure knows that server/app team like to blame network/security, from my experience, they usually first blame network before even checking server/app issue. Below is really good example how issue on their side can be proven.
Traffic hit security policy with statement allow, application is incomplete, so it means that session wasn’t established or no data were exchanged. Session end reason is tcp-rst-from-server, so because of some reason server dropped communication and this is 100% prove that it is server issue.
Palo Alto Networks firewalls are a little bit different comparing to others, their logging and visibility capabilities are superb. When you know what is a logic behind App-ID operations, definitely it can make your easier.