Palo Alto App-ID and application-default interview questions (PAN-OS 12.1)
13 questions with answers, the commands that prove them, and the likely follow-ups.
Interviewers test whether you know how App-ID names traffic, when policy is checked again, and why application-default stops an application on an odd port. Each answer below starts short, then shows the commands that prove it on PAN-OS 12.1.
Lab note: Lab 6 runs on a free, unlicensed VM-Series in PNETLab, with the App-IDs in the image’s bundled content. Policy Optimizer needs traffic logs, so that part runs on the Azure pod. The commands use the course lab: PA-FW1, LNX-CLIENT 10.10.2.10 in trust, LNX-WEB 10.10.3.10 in dmz.
01Fresher questions
How does App-ID identify an application?
App-ID names the application from the traffic itself, not the port. It uses application signatures, decryption with the signatures run again, protocol decoders, and heuristics for evasive applications.
Why it matters
The session must first match policy on zones, addresses and ports; then the signatures run on the allowed traffic. Protocol decoders also find applications tunnelled inside a protocol.
Prove it in the lab
pmladmin@PA-FW1> show session all filter source 10.10.2.10
pmladmin@PA-FW1> show session id <id>Look for: The application each session was identified as, such as web-browsing, ssl, dns or ssh.
Common wrong answer
“App-ID looks up the port in a table.” The port is only the starting point; App-ID reads the traffic itself.
Likely follow-up
How much can App-ID see in HTTPS without decryption? See HTTPS without decryption.
Practise this in Lab 6 of the PAN-OS 12.1 course.
What does service application-default mean, and why not use any?
With application-default, an allowed application matches only on its standard default ports, for example ssh on TCP 22. With any, the same application is allowed on every port, which helps evasive tools hide.
Why it matters
Palo Alto recommends application-default for allow rules. If a business application really runs on a non-standard port, add a service object for that port to one narrow rule.
Prove it in the lab
pmladmin@PA-FW1> show running security-policy
pmladmin@PA-FW1> test security-policy-match from trust to dmz source 10.10.2.10 destination 10.10.3.10 protocol 6 destination-port 22 application sshLook for: The test names the first matching rule, then its zones, addresses, applications and action. In the course lab, ssh on TCP 22 matches allow-trust-dmz-ssh.
Common wrong answer
“Service any is fine, because App-ID already checks the application.” With any, the application runs on every port, which is how tunnels and evasive tools hide.
Likely follow-up
Where do you see an application’s default ports? In Objects > Applications, under Standard Ports.
Practise this in Lab 6 of the PAN-OS 12.1 course.
What is the difference between an application group and an application filter?
An application group is a fixed list you maintain, such as APG-WEB-BASIC. An application filter is a saved query on category, subcategory, technology, risk, tags and characteristics, and new App-IDs that match it join automatically.
Why it matters
Filters suit block rules, for example high-risk file sharing. They are risky in allow rules, because a content update can quietly widen what the rule allows.
Prove it in the lab
pmladmin@PA-FW1> show config running | match APG-WEB-BASIC
pmladmin@PA-FW1> show running security-policyLook for: The group’s fixed members, web-browsing and ssl in the course lab, and the rules that use the group.
Common wrong answer
“Groups pick up new App-IDs automatically.” Only filters do; a group changes only when you edit it.
Likely follow-up
Which suits an allow rule for sanctioned applications? A group, so a content update cannot widen the rule.
Practise this in Lab 6 of the PAN-OS 12.1 course.
02Experienced questions
How much can App-ID see in HTTPS without decryption?
Only what crosses in the clear, such as the TLS handshake. App-ID can still name many HTTPS applications from it, but it cannot see inside the session.
Why it matters
An application labelled ssl is TLS whose application was not identified, and decryption reveals more. When a decryption rule applies, the firewall decrypts the session and runs the signatures again.
Prove it in the lab
pmladmin@lnx-client:~$ curl -sI https://example.com
pmladmin@PA-FW1> show session all filter source 10.10.2.10 destination-port 443
pmladmin@PA-FW1> show session id <session-id>Look for: The application of the TCP 443 session. The label ssl means TLS whose application App-ID did not identify.
Common wrong answer
“Without decryption, App-ID only ever shows ssl.” It reads the handshake and names many HTTPS applications.
Likely follow-up
What changes once you decrypt? The cleartext between the two TLS legs goes through App-ID and Content-ID.
Practise this in Labs 6 and 10 of the PAN-OS 12.1 course.
Why does the first security lookup use application any, and what is an application shift?
At session setup the firewall does not know the application yet, so it looks up policy with application any. When App-ID identifies the application, or later changes it, policy is checked again, so a session can end under a different rule.
Why it matters
A session can be allowed at first and blocked part-way. Design for it: a rule that allows only ssl does not allow every application that rides on SSL.
| Step | What happens |
|---|---|
| SYN | Security lookup with application “any”: the rule is a candidate. |
| Handshake | The session shows application “incomplete” until payload arrives. |
| SSH banner | App-ID names ssh, and policy is checked again with application ssh. |
| TCP 22 | ssh on TCP 22 is application-default: allowed, then Content-ID. |
| TCP 2222 | ssh on TCP 2222 is not application-default: no allow rule, so denied. |
LNX-CLIENT to LNX-WEB over SSH (trust to dmz), rule allow-trust-dmz-ssh. From the course notes, Session 6.
Prove it in the lab
pmladmin@PA-FW1> show session all filter source 10.10.2.10
pmladmin@PA-FW1> show session id <session-id>
pmladmin@PA-FW1> show log traffic direction equal backwardLook for: The application and rule of the live session, and the final application and rule in the traffic log.
Common wrong answer
“The rule matched at the first packet decides the whole session.” Every application change triggers another policy check.
Likely follow-up
Why can an App-ID rule let the first packets through? It stays a candidate until App-ID decides.
Practise this in Lab 6 of the PAN-OS 12.1 course.
What do incomplete, insufficient-data, not-applicable and unknown-tcp mean in the application column?
Incomplete means the TCP handshake did not complete, or no data followed it, and insufficient-data means too little data to identify. Not-applicable means traffic the firewall will discard, and unknown-tcp means no signature matched.
Why it matters
Each label points to a different fix. Not-applicable usually means no rule allows that port or service; unknown-tcp on legitimate traffic calls for a custom application.
Prove it in the lab
pmladmin@lnx-client:~$ nc -zv example.com 443
pmladmin@PA-FW1> show log traffic direction equal backwardLook for: The nc session in the traffic log. The nc command opens the connection and sends no data, which fits the definition of incomplete.
Common wrong answer
“unknown-tcp means malware.” It only means no App-ID matched. Capture packets, then build a custom application or submit the capture.
Likely follow-up
Which label appears when a session hits no allow rule on its port? Typically not-applicable. See SSH on TCP 2222.
Practise this in Lab 6 of the PAN-OS 12.1 course.
What are application dependencies, and how do you deal with them?
Some applications need others to work; an application that runs over SSL, for example, needs ssl allowed as well. Missing dependencies appear as App Dependency warnings at commit, and you allow them only where the business application needs them.
Why it matters
The warnings do not fail the commit, but they return on every commit until you resolve them. Missing dependencies give half-working applications.
Prove it in the lab
pmladmin@PA-FW1> configure
pmladmin@PA-FW1# validate full
pmladmin@PA-FW1# run show jobs id <jobid>Look for: A dependency warning such as Application 'open-vpn' requires 'ssl' be allowed, the course lab’s example. Current content may name different applications.
Common wrong answer
“Add every dependency to one global allow rule.” Allow a dependency only where the business application needs it.
Likely follow-up
What is the difference between Depends on and Implicitly Uses? You must allow Depends on applications yourself; Implicitly Uses applications are allowed for it.
Practise this in Lab 6 of the PAN-OS 12.1 course.
Custom application or application override: which do you choose?
Prefer a custom application with a signature, so App-ID names your traffic and Layer 7 inspection continues. An application override classifies traffic by zone, address, port and protocol only, and stops App-ID and threat inspection for it.
Why it matters
Override traffic is handled at Layer 4, so the security profiles can never inspect it. Use override only as a last resort, for example to work around a broken App-ID, and keep the rule narrow.
Prove it in the lab
pmladmin@PA-FW1# edit rulebase application-override rules ao-pml-8080
pmladmin@PA-FW1# set from trust to dmz source any destination H-LNX-WEB
pmladmin@PA-FW1# set protocol tcp port 8080 application pml-lab-app tag pml-lab-06
pmladmin@PA-FW1# top
pmladmin@PA-FW1# commitpmladmin@PA-FW1> test security-policy-match from trust to dmz source 10.10.2.10 destination 10.10.3.10 protocol 6 destination-port 8080 application pml-lab-appLook for: The rule that allows pml-lab-app in the test result. While the override is on, TCP 8080 sessions show pml-lab-app in the traffic log.
Common wrong answer
“App-ID still runs after the override.” It does not; overridden traffic skips App-ID and threat inspection.
Likely follow-up
Does a custom application used only by an override need a signature? No; such an application needs no signature.
Practise this in Lab 6 of the PAN-OS 12.1 course.
How does Policy Optimizer help you move from port-based rules to App-ID rules?
It lists port-based rules, those with no application set, with the applications that actually matched them. You can then clone each rule as an App-ID rule or add the seen applications to it.
Why it matters
Create Cloned Rule is the safe path: the new App-ID rule sits above the old one, which stays as a fallback. In PAN-OS 12.1 the view is called Rules Without App Controls; older releases call it No App Specified.
| Action | What it does |
|---|---|
| Create Cloned Rule | Adds a new App-ID rule above the old one; the old rule stays as a fallback |
| Add to This Rule | Converts the rule in place, with no fallback |
| Add to Existing Rule | Moves the applications into another App-ID rule |
| Match Usage | Copies every application seen, wanted or not |
Prove it in the lab
In the web interface: Policies > Policy Optimizer > Rules Without App Controls, then Apps Seen for a rule.
pmladmin@PA-FW1> show running security-policy
pmladmin@PA-FW1> show log traffic direction equal backwardLook for: Rules whose application is any, and the applications seen on each over the past 7, 15 or 30 days, or Anytime.
Common wrong answer
“Use Match Usage on every rule.” It allows everything that happened to pass through the rule, wanted or not; decide app by app.
Likely follow-up
When do you delete the old port-based rule? Once its hit count stops rising, after both rules have run side by side.
Practise this in Lab 6 of the PAN-OS 12.1 course, on the Azure pod.
03Scenario questions
A vendor needs SSH to LNX-WEB on TCP 2222. SSH on TCP 22 works and the rule allows ssh, but 2222 fails. Why?
The rule uses service application-default, and the default port for ssh is TCP 22, so a session to TCP 2222 does not match it. The session falls through to interzone-default and is denied.
Why it matters
The traffic log shows the deny, typically with the application not-applicable: the firewall decided to discard the traffic on its port alone. You see that log only because interzone-default was overridden to log.
Prove it in the lab
pmladmin@PA-FW1> test security-policy-match from trust to dmz source 10.10.2.10 destination 10.10.3.10 protocol 6 destination-port 22 application ssh
pmladmin@PA-FW1> test security-policy-match from trust to dmz source 10.10.2.10 destination 10.10.3.10 protocol 6 destination-port 2222 application ssh
pmladmin@PA-FW1> show log traffic direction equal backwardLook for: allow-trust-dmz-ssh for port 22 but not for port 2222, and the interzone-default deny in the log.
Common wrong answer
“Change the rule’s service to any.” That opens ssh on every port. Add a narrow rule with a service object for TCP 2222, limited to that source and destination.
Likely follow-up
How do you prove the fix? Run the same test security-policy-match before and after the change.
Practise this in Lab 6 of the PAN-OS 12.1 course.
After an Applications and Threats update, a business application stopped working. What happened, and what do you do?
A new or modified App-ID probably names that traffic as an application your rule does not allow. Find the new application name and the rule that matched in the traffic log.
Why it matters
Short term, add the new application to the right rule or revert to the previous content release. Long term, schedule updates with a threshold delay and review new App-IDs before they install. New App-IDs are published monthly, on the third Tuesday.
Prove it in the lab
pmladmin@PA-FW1> show system info | match app-version
pmladmin@PA-FW1> request content upgrade info
pmladmin@PA-FW1> show log traffic direction equal backwardLook for: The installed content version, the available releases, and the new application name with the rule it matched.
Common wrong answer
“Set the rule’s application to any until it works.” That widens the rule for every application; add the one new App-ID instead.
Likely follow-up
How do you stop a repeat? Use the New App-ID threshold, which gives you time to review new App-IDs before they change policy results.
Practise this in Labs 1 and 6 of the PAN-OS 12.1 course.
Policy Optimizer shows no application usage for a busy rule. Users browse all day. Why?
On-box Policy Optimizer counts applications only from traffic logs written at session end. If the rule logs at session start only, there is nothing to count, so enable Log at Session End.
Why it matters
Log at Session End is on by default on normal rules, so someone turned it off. Policy Optimizer also needs traffic logs stored on the firewall.
Prove it in the lab
In the web interface: Policies > Security, open the rule, then the Actions tab: Log at Session End.
pmladmin@PA-FW1> show log traffic direction equal backwardLook for: No session-end entries for that rule before the fix. Once new sessions end, entries appear and the rule’s Apps Seen fills in.
Common wrong answer
“Policy Optimizer needs SCM Pro on the firewall.” The on-box Policy Optimizer needs session-end traffic logs, not an SCM licence.
Likely follow-up
Which views does Policy Optimizer offer in 12.1? New App Viewer, Rules Without App Controls, Unused Apps and Rule Usage.
Practise this in Lab 6 of the PAN-OS 12.1 course, on the Azure pod.
Someone removed web-browsing from APG-WEB-BASIC. Now HTTP from LNX-CLIENT fails, while HTTPS still works. Why?
The rule still allows ssl, so HTTPS works, but no rule now allows any application on TCP 80. The firewall denies the first HTTP packet at interzone-default, before App-ID even runs.
Why it matters
This is the everyday cost of App-ID: you allow what you name. A change to a shared group changes every rule that uses it.
Prove it in the lab
pmladmin@PA-FW1> test security-policy-match from trust to untrust source 10.10.2.10 destination 1.1.1.1 protocol 6 destination-port 80 application web-browsingpmladmin@PA-FW1# set application-group APG-WEB-BASIC members [ web-browsing ssl ]
pmladmin@PA-FW1# commitLook for: No allow rule in the test result, and TCP 80 sessions denied by interzone-default in the traffic log. After the fix, the test matches allow-trust-web again.
Common wrong answer
“The ISP or DNS broke HTTP.” HTTPS still works from the same host, and the policy test shows the deny.
Likely follow-up
Why not add service any to fix it fast? It would allow the application on every port; put web-browsing back in the group instead.
Practise this in Lab 6 of the PAN-OS 12.1 course.
Related
Sources
The answers come from the course kit, whose writers checked them against these Palo Alto Networks pages on 13 Oct 2026. Recheck behaviour on your own release.
- App-ID Overview (Palo Alto Networks): how App-ID identifies applications.
- Not-Applicable, Incomplete, Insufficient Data in the Application Field (Palo Alto Networks Knowledge Base): the meaning of each application label.
- Packet Flow Sequence in PAN-OS (Palo Alto Networks Knowledge Base): the first lookup with application any, and the policy re-check after App-ID.
- Building Blocks in a Security Policy Rule (PAN-OS 12.1 help) (Palo Alto Networks): application-default versus any, and logging defaults.
- Resolve Application Dependencies (Palo Alto Networks): dependency warnings at commit.
- Application Override (PAN-OS 12.1 help) (Palo Alto Networks): what an override skips, and why a custom application is preferred.
- Manage Custom or Unknown Applications (Palo Alto Networks): unknown-tcp and custom applications.
- Security Policy Rule Optimization (Palo Alto Networks): Policy Optimizer, session-end logs and on-demand data from 12.1.2.
- Migrate Port-Based to App-ID Based Security Policy Rules (Palo Alto Networks): the migration actions and application-default.
- Security Policy Optimizer (PAN-OS 12.1 help) (Palo Alto Networks): the 12.1 view names.
- Objects > Application Filters (PAN-OS 12.1 help) (Palo Alto Networks): application filter attributes.
- Device > Dynamic Updates (PAN-OS 12.1 help) (Palo Alto Networks): the threshold and the New App-ID threshold.
- Dynamic Content Updates (PAN-OS 11.1) (Palo Alto Networks): the monthly release of new App-IDs.
- Test the Configuration (CLI Quick Start) (Palo Alto Networks): test security-policy-match.