What is application ID or application control? Firewalls vendors have different naming conventions. Normally, as match criteria in firewall access policies layers 3 and 4 can be used. So, access policies can be configured based on ip addresses and ports. Are there any issue with L3/L4 access policies? First example, let’s allow/block access to Facebook/Gmail/Netflix using ip addresses, is that possible? Not really. Second example, DNS need to be allowed (tcp/udp 53). What will happen when as example Bittorrent will use port 53? Traffic will be allowed. Basically, using L3/L4 only we cannot configure granular access policies and our data cannot be controlled as we wish.
Application control solves above problems, access policies can be configured using L7 at application layer. Apart from ip addresses and ports, directly application like Facebook/Gmail/Netflix/DNS can be used to allow/block traffic.
Every UTM/NGFW vendor support application identification, why Palo Alto Networks is different here comparing to others, let’s go into details:
- Application identification is native, cannot be disabled. Whole traffic flowing through firewall is inspected by App-ID engine.
- Other vendors match traffic based on L3/L4 and than traffic can be inspected by application control. PANW logic is completely different, traffic is matched based on L7 directly.
- Applications and URL Filtering can be mixed as match criteria in one security.
Thanks to above, PANW deliver superb visibility, firewall is so granular in terms of security policies and as outcome, attack surface can be greatly limited . Of course, it required proper configuration approch, PANW still can be used like typical firewall. As example, let’s consider below scenario:
Zero-day threat trying to communicate over port 53. On the traditional firewall, security policy is based on port 53, zer-day so threat signature doesn’t exist – traffic allowed. PANW has capability to block such traffic without knowing that this is a threat. Like a mention, whole traffic flowing through the firewall is identified by App-ID engine, of course there is no option that firewall will recognize everything. When application is not identified, than firewall adds label to traffic: unknown-tcp, unknown-udp or unknown-p2p. In our example, PANW allowed traffic based on application DNS, zero-day is something completely unknown, so firewall will mark it as unknown and blocked because DNS is allowed only. Basically according best practisies, unknown application should be block for inbound/outbound traffic. Signature coverage for public applications is quite good. So when firewall cannot recognize traffic from/to internet by App-ID , definitely it is something suspicious. Using proper configuration approach, firewall can block some threats without any signatures, this is a power of App-ID.
According to datasheets, firewalls are doing more or less same things, but small details makes huge differences.