How To Implement App-ID on Your Next-Generation Firewall

Watch the video to learn how to implement App-ID on your next-generation firewall to protect against increasingly evasive threats and prevent successful cyber breaches.

[bobdodd]

Blocking websites is a different column in the and logic.

[Raymix]

There is a serious flaw with App-ID
Most (if not all) applications require web-browsing and ssl to be enabled and as soon as those 2 are enabled, suddenly most the web traffic is also enabled.
This is due to limitation in policy logic - each column works as AND operator and each row works as OR operator.
Enabling "application-default" service has no effect, I would expect it to open ports defined in applications to their allowed destinations, but it does not work that way.
Example: create policy with 3 applications - facebook-base, web-browsing and ssl. This will open internet connection to thousands of websites not just facebook.

Solution - give us choice of AND operator within each cell!
Example - ((facebook-base OR twitter-base) AND (web-browsing))
So web-browsing is only allowed on facebook and twitter, not on its own.
This way we can define allowed applications in one place.

Workaround - there is no workaround. Even if you add ports 80 and 443 under service tab (since it works as AND operator for Application tab), Palo Alto will throw dependency warnings.
Don't add web-browsing, ssl together with service ports 80 and 443, this will also give dependency warnings for no reason.

TL:DR - Stop enforcing web-browsing and ssl applications as dependencies for other applications, they ruin everything when enabled.

PAN OS 7.1.7

edit: fixing some mistakes