Without App-ID, your firewall would be like a security guard who only checks the colour of a car but never looks at who is driving or what they are carrying. This chapter explains how Palo Alto Networks firewalls identify applications by their behaviour rather than by their port numbers, enabling you to write security policies that control exactly which apps are allowed and what they are allowed to do.
Jump to a section
A simple way to picture App-ID: Application Identification and Control
A busy nightclub entrance on a Saturday night. A long queue of people waits outside, but the bouncer at the door isn't just checking ID cards. He watches how each person behaves. He sees one group holding party sparklers—they're clearly here for a birthday celebration. Another person tries to push past with a toolbox—he's a technician here to fix the sound system. A third group wears matching shirts with a company logo—they're hosting a corporate event.
The old way of security was simple: the bouncer only checked if someone had a valid ID. That told him the person's age and name, but nothing about why they were there. Anyone with a valid ID could enter, whether they were a drunken troublemaker or the responsible party host. This is like traditional firewalls that only check IP addresses and port numbers.
App-ID works like that observant bouncer who doesn't just check IDs but identifies what each person actually plans to do. It looks at the behaviour—the sparklers, the toolbox, the company shirts—and recognises the real purpose. The bouncer can then apply different rules: party-goers can enter the main floor, the technician gets escorted to the backstage area, and the corporate group is directed to the VIP lounge. App-ID uses multiple detection techniques to identify the exact application traversing your network, not just the port or protocol it claims to use.
App-ID is the core technology that makes Palo Alto Networks firewalls different from traditional firewalls. Before App-ID existed, firewalls could only see the IP address and port number of traffic. They assumed that traffic on port 80 was web browsing, traffic on port 443 was secure web browsing, and traffic on port 25 was email. This assumption was dangerously wrong because many applications today disguise themselves by using common ports. For example, Facebook Messenger can use port 443, which is normally used for secure web traffic. A traditional firewall looking only at port numbers would think it's just a person browsing the web, when in reality someone might be exfiltrating sensitive company data through a chat application.
App-ID is a multi-layered identification engine built into every Palo Alto Networks firewall. It does not rely on any single method to identify applications. Instead, it uses up to five different identification techniques simultaneously to determine the exact application being used. These techniques are:
Application signatures: The firewall has a database of thousands of application signatures. Each signature is like a unique fingerprint that describes the specific network behaviour of an application. When traffic passes through the firewall, it compares the traffic patterns against these signatures.
Protocol decoding: The firewall actually decodes the application protocol to understand what is happening inside the traffic. For example, it can decode HTTP traffic to see the specific URL requested, the user agent string, and the HTTP methods being used.
SSL/TLS decryption: If traffic is encrypted, App-ID can inspect the SSL/TLS handshake. It looks at the Server Name Indication (SNI) field, which contains the domain name the client is trying to reach. It also examines the certificate details. Even without decrypting the actual data, this often reveals the application.
Behavioural analysis: Some applications try to evade detection by mimicking legitimate protocols. App-ID monitors traffic behaviour over time. If a connection shows odd patterns—like sending data in bursts at unusual times, or using non-standard packet sizes—the firewall flags it for deeper inspection.
Custom App-IDs: If an organisation uses a proprietary or internal application that is not in the default database, administrators can create custom App-IDs. They teach the firewall what that specific application looks like on the network.
Once App-ID identifies the application, the firewall can enforce policies based on that identification. You can create a rule that says "Allow Salesforce but block Facebook" even though both might use ports 80 and 443. You can also create rules that control application functions. For instance, you can allow the file-sharing application Dropbox for downloading files but block file uploads within that same app. This is called Application Function Control.
Why does this matter for a network security engineer? Because modern threats rarely come through obvious attack vectors. An attacker might compromise a user's system and then use a legitimate application like Slack or LinkedIn to communicate with a command-and-control server. App-ID will detect that the application is Slack, but if your policy allows Slack, it will permit the traffic. To prevent this, you can use App-ID in combination with other security features like Content-ID (which inspects the actual content of files) and User-ID (which maps traffic to specific users).
App-ID also enables visibility. Even without blocking anything, you can run reports that show exactly which applications are running on your network. You might discover that employees are using personal cloud storage apps or peer-to-peer file sharing software, which could expose sensitive corporate data. Once you have that visibility, you can decide whether to block, allow, or restrict those applications.
Imagine you are the sole IT security person at a mid-sized law firm with 200 employees. The partners have complained that the network feels slow during business hours. Your first step is not to buy more bandwidth, but to understand what is consuming the bandwidth.
You log into the Palo Alto Networks firewall and run an application visibility report. The report shows that 40% of network traffic is YouTube video streaming, 25% is Spotify music streaming, 15% is Facebook and Instagram, and only 20% is actual business-related traffic like Microsoft 365 and legal research databases.
Now you need to act. You create a security policy rule that uses App-ID to identify YouTube and Spotify. For the regular employees, you set the action to "deny" during core business hours (9am to 5pm). But senior partners are exempt, so you also use User-ID to create an exception for their group. Within the same rule, you enable Application Function Control to block uploading of files to social media sites, because a paralegal might accidentally share a confidential client document through Facebook Messenger.
Another scenario: The firm uses a custom web-based case management application that runs on port 8080. Traditional firewalls would allow all traffic on port 8080, which could include games, proxies, or unapproved applications. With App-ID, you can create a custom App-ID that exactly matches the case management application's traffic patterns. Then you write a policy that only allows that specific application on port 8080, and blocks everything else trying to use that port.
A third scenario: You receive an alert that a user's workstation is sending a large amount of data to a server in a foreign country. The traffic uses HTTPS on port 443. Without App-ID, you might think it's just normal web traffic. But App-ID identifies the application as "BitTorrent" even though it is using port 443. The user has installed a torrent client to download pirated movies using the firm's internet, and it's wrapped in HTTPS to evade detection. You immediately block the application and investigate the workstation for malware.
The process of implementing App-ID in a real environment involves several steps:
Step 1: Turn on logging for all traffic to build a baseline of what applications exist on your network.
Step 2: Review the application reports and identify risky or unwanted applications.
Step 3: Create a "deny" rule for unwanted applications, placing it above your allow rules in the rulebase order.
Step 4: For legitimate applications you want to allow, create rules that also enable security profiles (like antivirus and vulnerability protection) to inspect the traffic.
Step 5: Periodically review the logs to catch new applications that users may have started using.
The PCNSE exam tests your understanding of how App-ID works, what it replaces, and how to configure it correctly. Here is what you need to know:
First, memorise the five identification methods: application signatures, protocol decoding, SSL/TLS decryption, behavioural analysis, and custom App-IDs. The exam will present a scenario and ask which method is being used. For example: "A firewall identifies an application by analysing the SNI field in the TLS handshake. Which App-ID technique is being used?" The answer is SSL/TLS decryption.
Second, understand that App-ID is performed before security policy lookup. The firewall first identifies the application, then checks the policy rules. If you think the firewall checks the policy first and then identifies the app, you will get the question wrong. The order is: packet arrives, App-ID identifies the application, then the firewall compares against the security policy.
Third, know the difference between App-ID and port-based firewalling. The exam loves to test this by giving you a scenario where an application uses a non-standard port. For example: "An organisation wants to allow SSH on port 2222 instead of port 22. Can App-ID identify SSH on port 2222?" Yes, because App-ID identifies the application by its behaviour, not by the port number.
Fourth, understand application dependencies. Some applications depend on other applications to function. For example, a custom database application might depend on DNS to resolve hostnames. When you write a policy, you must ensure that all dependencies are allowed. The exam might ask: "What happens if you allow an application but block its dependency?" The application will fail.
Fifth, be careful with the concept of "Unknown TCP/UDP" traffic. When App-ID cannot identify an application, it labels it as "incomplete" or "unknown". The exam will test what you should do with unknown traffic. The correct answer is to create a rule that allows unknown traffic only if necessary, and to configure App-ID to learn more by enabling "verify update" or creating custom signatures.
Sixth, trap question pattern: The exam may ask, "Can App-ID identify applications that use custom encryption?" The answer is yes, partially. App-ID can identify the application by the handshake behaviour even if the payload is encrypted. It uses SSL/TLS fingerprinting and SNI to make a best guess.
Seventh, know the default action for App-ID. If no security policy matches, the default action is to deny the traffic. But the firewall will still attempt to identify the application before dropping it.
Eighth, understand that App-ID is not limited to TCP and UDP. It can also identify applications that use other protocols like ICMP or GRE, though the exam focuses on TCP and UDP.
App-ID identifies applications based on behaviour, not port numbers, so it can detect applications using non-standard ports.
The five App-ID identification methods are application signatures, protocol decoding, SSL/TLS decryption, behavioural analysis, and custom App-IDs.
App-ID operates before the security policy lookup, so the firewall identifies the application before checking what rule applies.
App-ID can identify many encrypted applications without full decryption by analysing the TLS handshake and SNI fields.
Unknown or incomplete traffic requires careful policy handling and may need custom App-IDs for proper identification.
App-ID is the foundation for all other security functions on a Palo Alto Networks firewall, including Content-ID, User-ID, and Threat Prevention.
Application dependencies must be considered when writing policies, or legitimate applications may fail to function.
The default policy action is to deny traffic, but App-ID still attempts identification before the drop action occurs.
Mistake
App-ID only works if you enable SSL decryption and decrypt all encrypted traffic.
Correct
App-ID can identify many encrypted applications without decryption by analysing the TLS handshake, SNI, and certificate information.
Beginners think encryption makes all traffic invisible, but App-ID uses metadata from the encryption handshake itself.
Mistake
If you block port 443, you block all HTTPS applications.
Correct
Blocking port 443 blocks all traffic on that port, but many applications can use other ports or wrap themselves in other protocols.
This misconception comes from the old port-based firewall mentality where ports equalled applications.
Mistake
App-ID identifies applications by looking at the source and destination IP addresses.
Correct
App-ID ignores IP addresses and relies on application signatures, protocol decoding, and behavioural analysis.
Beginners confuse App-ID with traditional access control lists (ACLs) that filter by IP.
Mistake
Once App-ID identifies an application, you do not need any other security features like antivirus or intrusion prevention.
Correct
App-ID only identifies the application; it does not inspect the content for threats. You still need Content-ID and Threat Prevention for malware and exploits.
People assume identification equals protection, but identification is just the first step.
Mistake
App-ID can identify all applications 100% of the time without any configuration.
Correct
App-ID is highly accurate, but some custom or obfuscated applications may require creating custom App-IDs or enabling advanced analysis.
Vendor marketing often implies perfect detection, but real-world traffic includes proprietary apps and evasion techniques.
Mistake
You must create a security policy rule for every single application you want to allow.
Correct
You can create broad rules that allow categories of applications (e.g., "social-networking") and use App-ID to enforce the policy within that category.
Beginners think each app needs its own rule, but App-ID supports application groups and filters.
You've finished App-ID: Application Identification and Control. Continue through the PCNSE study guide to build a complete picture of the exam.
Done with this chapter?