App-ID is a core technology of Palo Alto Networks’ next-generation firewalls (NGFWs) that identifies applications traversing the network, regardless of port, protocol. Custom App-ID extends this capability by allowing to create unique signatures for proprietary or obscure applications that are not covered by the default App-ID database. This ensures that all applications, including those specific to your organization, can be accurately identified and controlled.
There are many reasons to deploy custom App-ID, such as better visibility, improved control of data, and the ability to identify unknown traffic for threats. Custom App-ID capabilities are quite powerful, and you can use them for purposes you might not initially consider. Let’s dig in.
Creating a custom App-ID involves several steps, including traffic capture, pattern analysis, and signature creation.
The first step in creating a custom App-ID is to capture the traffic of the packets you want to identify. Palo Alto Networks has a built-in packet capture feature. Typically, only the transmit and receive stages are necessary for custom application captures. If you name the stage files exactly the same, the firewall will merge all stages into one pcap file.
Than look for unique patterns or characteristics that can be used to identify the application. This might include specific sequences of bytes, header information, or other distinguishing features. For my custom application, I want to look for an HTTP header called User-Agent. The User-Agent header in HTTP requests is a string that provides information about the client making the request. This information typically includes the type of device, the operating system, the browser name and version, and other relevant details. The User-Agent header helps web servers identify the characteristics of the client, allowing them to deliver content optimized for the client’s specific environment.
With the traffic patterns identified, I can now create a custom signature. This involves defining rule(s) that match the unique characteristics of the application. Custom applications are managed under the same section as other apps, found in Objects -> Applications. My custom App-ID is called FF-Browser.
Under the Advanced tab, the defaults section includes parameters used as Application defaults, such as default ports or protocols for a particular App-ID. In my case, it is none, and you will soon see why.
The key is under Signature. I’m looking for the pattern “Firefox” in the context of http-req-user-agent-header.
I have configured a firewall policy to block my custom App-ID FF-Browser as well.
Let’s test it by trying to visit Reddit using Firefox and Chrome.
As seen above, now I can control which browser is allowed. All web traffic generated by Firefox is identified as FF-Browser.
My custom app is a good example of why it’s important to develop signatures in a lab environment first. FF-Browser is quite broad, and if you develop a similarly broad app, it can affect your production environment.
Custom App-ID is a powerful feature of Palo Alto Networks’ NGFWs that allows for precise identification and control of any traffic. Essentially, it’s a matter of finding a way to differentiate traffic, and you can accomplish a lot. For instance, you can easily allow access to a website but block the capability to download files.