Question 286 - PCNSE discussion

According to the Palo Alto Networks documentation1, application override is where the firewall is configured to override the normal application identification (App-ID) of specific traffic passing through the firewall. To implement application override, the following items must be configured: Custom app: This is a user-defined application that is used to identify the traffic that needs to be overridden. It is recommended to create a custom app for the application override policy, rather than using a predefined app that may have different default ports and threat inspection capabilities2.

Security policy rule: This is a rule that allows the traffic that matches the custom app through the firewall. The security policy rule must use the custom app as the application filter and specify the source and destination zones, addresses, and users as needed2.

Application override policy rule: This is a rule that defines the criteria for overriding the App-ID of the traffic. The application override policy rule must use the custom app as the application filter and specify the source and destination zones, addresses, ports, and protocols as needed2. The other options are not required or relevant for implementing application override:

Decryption policy rule: This is a rule that defines the criteria for decrypting encrypted traffic. It is not related to application override, although decryption may be needed to identify some applications that use encryption.

Application filter: This is an object that groups applications based on various criteria, such as category, subcategory, technology, or risk. It is not an item that must be configured for application override, although it can be used as a reference in security policy rules or custom apps.

Reference: 1: https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-how-to-create-anapplication-override/ba-p/451872 2:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0 :

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/decryptionconcepts/how-decryption-works : https://docs.paloaltonetworks.com/pan-os/9-1/pan-osadmin/app-id/manage-custom-or-unknown-applications/create-an-application-filter