How to Configure APP-ID in Palo Alto | Detailed Explanation| LAB| DAY 42 |

You can support my work on Patron : / bikashtech
Hi Friends,
This video shows How to Configure APP-ID in Palo Alto with LAB and also with Detailed Explanation . If you like this video give it a thumps up and subscribe my channel for more video. Have any question or suggestion put it on comment
section.
Please follow me
Subscribe: bit.ly/3eFwHiy
KZbin: / bikashstech
Twitter: / bikashshaw82
Facebook: / 100003333695682
Instagram: / bikashtech
Facebook group URL
/ 197882327937667
Please find the link below for downloading images of network devices and EVE-ng file
drive.google.c...
#paloaltofirewalltraining #APP-ID #bikashtech

[@BikashsTech]

Hello Friends, Please Comment what you have learnt from this video. Share, Support, Subscribe!!! Patron : www.patreon.com/Bikashtech Subscribe: bit.ly/3eFwHiy KZbin: kzbin.info Twitter: twitter.com/Bikashshaw82 Facebook: facebook.com/people/Bikash-Kumar-Shaw/100003333695682 Instagram: instagram.com/bikashtech/

[@nitinchikane4707]

Appreciate your efforts for video tutorials! Please make videos on palo Alto troubleshooting like IPSEC,SSL VPN etc

[@RyanBess]

At 17:18, the DNS traffic was allowed. As DNS is is UDP (in most cases) there's no FIN thus I suspect that is why it was aged-out. The "in-Out" policy to start with is wide open as long as the app is using default ports that traffic was good to go. Once you updated it to support only facebook, yup that killed any traffic other than facebook. The demo you were showing that DNS traffic should have landed on the interzone-default and thus that is where it would have been denied (not that it was aged out). Yes, adding DNS back to the appid and using application default fixed it. Keep your demo's up!

[@MofistagoMofarde]

Hey Ryan, so does UDP traffic always show "aged-out" when being blocked by security policy?

[@RyanBess]

@@MofistagoMofarde if it’s blocked no session should be created.

[@faizankhan8260]

Great video to understand APP-ID of PA

[@omkarghale3438]

Great Bro you tought us in simple way

[@irshadiqbalkm]

Excellent💐

[@infotech5496]

Excellent keep doing

[@Littlegujju-avengers]

Nice video dear, I want to know about custom app ID filtering.. how to block get, and post base requests for private app which are not included in Palo Alto app id.

[@akshayshahane4311]

Can you please upload a troubleshooting video

[@ketansakpal9566]

please make one video for packet flow

[@vivekprajapati7911]

Very good sir..

[@kaung5628]

Hi bro, APP-ID can block facebook-chat,facebook-video and etc. How does App-id knew these traffic is chat traffic, video traffic. In SSL/TLS , a connection between client and server is secured(encrypted) ?. How firewall can know if the traffice is secured ? ....

[@vivektyagi3654]

brillant.....can u share some interview Q&A for PA FW ?

[@sonarsan]

Bikash, how do you install pa-vm on eve-ng?

[@himanshuyadav3380]

Hellow sir nice video Sir last me aapne solution nhi bataya. Please sir answer

[@mdabdulmoiz]

Awesome

[@soumenchatterjee3657]

When come migration Checkpoint to Paloalto

[@emonhossain4353]

Can you make it hindi.

[@sai-icts2243]

Can u please help me to sort out my query: We currently do not do traffic decryption on the firewall for deep packet inspection. Can we safely consider converting eligible rules to application based rules even though we don't do any traffic decryption on the perimeter firewall? My concern is that since we don't decrypt traffic on the perimeter firewall we will not be able to accurately identify application traffic.

[@BikashsTech]

Hi Sai, Good Question, Firewall can only assume based on the information which is not encrypted like port number (if it is 443 then https, it can't recognize facebook-chat or facebook-video)

[@franciscoromero5958]

Could you please explain how to block&unblock subtabs like facebook-chat. I did understand how the PA identify it, however I could see the way to block subtabs... thank you for your help

[@rajkumarthirugnanasambanth6378]

How to create custom app id

[@prashanthkumar8314]

What is the difference between FQDN and URL

[@BikashsTech]

Hi Prasath, For Easy understanding FQDN : Name of the server URL : Path to get the file (file location)

[@DeepakKumar-ov8ko]

PA can block the tls traffic based on SNI in client hello packet or Common name field in certificate exchanged in server hello packet in case sni is not supported by web server.So my question is facebook is allowed and is encrypted .But if anyone try to access facebook chat ,since application data is fully encrypted so how firewall can know without ssl decryption just on sni or cn field ?

[@BikashsTech]

Hello Deepak, Want to know more about question. Which server will not aupport SNI, is it Facebook?

[@DeepakKumar-ov8ko]

@@BikashsTech webserver are configured to support this "sni" feature specially useful for shared hosting website where multiple TLS server are running with different domain on a single public ip. Facebook support sni .But my question is that in TLS client hello Facebook .com will be as sni .once encrypted even firewall cannot see inside the packet until some sort of decryption is not performed at pa level.so how app id will work just on sni basis to identify chat app in facebook

[@anilkrishnam8889]

How can I block mobile Facebook application in PA220