Threat Protection and Advance Threat Protection scanning is bypassed when Custom App IDs are configured for Unknown Traffic

• Custom App-ID is configured to identify unknown traffic (unknown-req-tcp-payload, unknown-rsp-tcp-payload, unknown-req-udp-payload, unknown-rsp-udp-payload) 
• AND  
• “Continue scanning for other applications” setting is enabled in the Custom App-ID, OR “Vulnerability Protection” profile is attached to the Security Policy to allow traffic identified with these Custom App-IDs.

• Palo Alto Firewalls.
• PAN-OS 9.1 and higher.
• Custom App-ID
• Vulnerability Protection

How do I know if I am impacted?

• Step 1: Go to Panorama or FW UI and look for Custom App-IDs using Unknown Traffic (GUI: Objects > Applications > Use dropdown button to select "Custom Applications".

• Click on the Application to check for "Context". The example below shows a Custom Application configured with unknown-udp payload context for the defined signature.  

• Step2: Check if the setting "Continue scanning for other Applications" is enabled.
  
  
  Step3: Check if the Vulnerability Profile is attached to the Security Policy rule that allows Custom App-ID
  
  
  
  If Step 1 is TRUE, and either Step2 or Step3 is TRUE then the firewall is impacted by the Fix. Continue reading to learn how to prepare for the fix.

How to prepare for the fix?

Review all Custom App-IDs to see if they meet the conditions mentioned above. Use one of the options below to prepare. 

• Option 1 (Recommended): Test Custom App-ID traffic in the lab:
  1. Capture traffic that is identified with this Custom App-ID, detailed here. 
  2. Replay the pcap in a lab environment on a FW without the Custom App-ID.
  3. If the traffic is identified as unknown-tcp or unknown-udp, then there should be no impact (after installing the Content Update, this traffic will continue to be identified with your Custom App-ID). 
  4. If the traffic is identified with another App-ID, then add this new App-ID into the Security Policy rule to allow this traffic.
• Option 2: Use Application Filters
• This option is good for customers who confidently understand their Custom App-ID traffic, for example, the category and sub-category it fits into. 
  1. Create an Application Filter for the Category and Sub-Category of Applications that the Custom App-ID fits into. For example, if the Custom App-ID traffic is related to OT/ICS protocols, use the App-ID Filter that will select all App-IDs from the “ics-protocols” subcategory. 
  2. Next, attach this Filter to the Security policy rule with the action “Allow” and place it at the bottom of your Policy rule set. 
  3. Update the Applications & Threats (Content). 
  4. In a few days after installing the Content Update, review the rule usage statistics in Policy Optimizer. If the traffic is identified with another App-ID, then add this new App-ID into the Security Policy rule to allow this traffic. 
  5. Remove the Application Filter, when done.

Please ensure to apply the fix before Applications & Threat (Content) update scheduled on October 17, 2023