Create a Custom Application (PAN-OS & Panorama)

1. Gather information about the application that you will be able to use to write custom signatures.

   To do this, you must have an understanding of the application and how you want to control access to it. For example, you may want to limit what operations users can perform within the application (such as uploading, downloading, or live streaming). Or you may want to allow the application, but enforce QoS policing.

   • Capture application packets so that you can find unique characteristics about the application on which to base your custom application signature. One way to do this is to run a protocol analyzer, such as Wireshark, on the client system to capture the packets between the client and the server. Perform different actions in the application, such as uploading and downloading, so that you will be able to locate each type of session in the resulting packet captures (PCAPs).
   • Because the firewall by default takes packet captures for all unknown traffic, if the firewall is between the client and the server you can view the packet capture for the unknown traffic directly from the Traffic log.
   • Use the packet captures to find patterns or values in the packet contexts that you can use to create signatures that will uniquely match the application traffic. For example, look for string patterns in HTTP response or request headers, URI paths, or hostnames. For information on the different string contexts you can use to create application signatures and where you can find the corresponding values in the packet, refer to Creating Custom Threat Signatures.
2. Add the custom application.

   1. Select ObjectsApplications and click Add.
   2. On the Configuration tab, enter a Name and a Description for the custom application that will help other administrators understand why you created the application.
   3. (Optional) Select Shared to create the object in a shared location for access as a shared object in Panorama or for use across all virtual systems in a multiple virtual system firewall.
   4. Define the application Properties and Characteristics.

3. Define details about the application, such as the underlying protocol, the port number the application runs on, the timeout values, and any types of scanning you want to be able to perform on the traffic.

   On the Advanced tab, define settings that will allow the firewall to identify the application protocol:

   • Specify the default ports or protocol that the application uses.
   • Specify the session timeout values. If you don’t specify timeout values, the default timeout values will be used.
   • Indicate any type of additional scanning you plan to perform on the application traffic.

   For example, to create a custom TCP-based application that runs over SSL, but uses port 4443 (instead of the default port for SSL, 443), you would specify the port number. By adding the port number for a custom application, you can create security rules that use the default port for the application rather than opening up additional ports on the firewall. This improves your security posture.

4. Define the criteria that the firewall will use to match the traffic to the new application.

   You will use the information you gathered from the packet captures to specify unique string context values that the firewall can use to match patterns in the application traffic.

   1. On the Signatures tab, click Add and define a Signature Name and optionally a Comment to provide information about how you intend to use this signature.
   2. Specify the Scope of the signature: whether it matches to a full Session or a single Transaction.
   3. Specify conditions to define signatures by clicking Add And Condition or Add Or Condition.
   4. Select an Operator to define the type of match conditions you will use: Pattern Match or Equal To.

      • If you selected Pattern Match, select the Context and then use a regular expression to define the Pattern to match the selected context. Optionally, click Add to define a qualifier/value pair. The Qualifier list is specific to the Context you chose.
      • If you selected Equal To, select the Context and then use a regular expression to define the Position of the bytes in the packet header to use match the selected context. Choose from first-4bytes or second-4bytes. Define the 4-byte hex value for the Mask (for example, 0xffffff00) and Value (for example, 0xaabbccdd).

      For example, if you're creating a custom application for one of your internal applications, you could use the ssl-rsp-certificate Context to define a pattern match for the certificate response message of an SSL negotiation from the server and create a Pattern to match the Common Name of the server in the message as shown here:

   5. Repeat steps 4.c and 4.d for each matching condition.
   6. If the order in which the firewall attempts to match the signature definitions is important, make sure the Ordered Condition Match check box is selected and then order the conditions so that they are evaluated in the appropriate order. Select a condition or a group and click Move Up or Move Down. You can't move conditions from one group to another.
   7. Click OK to save the signature definition.
5. Save the application.

   1. Click OK to save the custom application definition.
   2. Click Commit.
6. Validate that traffic matches the custom application as expected.

   1. Select PoliciesSecurity and Add a Security rule to allow the new application.
   2. Run the application from a client system that is between the firewall and the application and then check the Traffic logs (MonitorTraffic) to make sure that you see traffic matching the new application (and that it's being handled per your policy rule).