Palo Alto App-ID Unknown-TCP: When to Use Application Override vs More Time

Palo Alto · Techclick CLI troubleshooting lab

A custom TCP 9443 app is denied as unknown-tcp. Security wants an application-override. You have five minutes to decide if that is safe.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Palo Alto for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

unknown-tcp means App-ID did not finish. Give it time and a decoder first. Application-override is a scalpel for a known private protocol, not a shortcut for every deny.

Why this ticket shows up

Override skips threat decoders for that port. Used on a real web app, you just turned off IPS for that path.

Symptoms operators actually see

• Traffic log application unknown-tcp

• Session incomplete

• Custom vendor appliance on a high port

• Works when the rule allows any

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show session all filter application unknown-tcp
show session id <id>
show counter global filter delta yes | match appid
show running application-override
test security-policy-match from trust to dmz source 10.1.1.10 destination 10.9.9.9 destination-port 9443 protocol 6

How to read that output

If the session is still incomplete, wait — App-ID needs a few packets. If it is a fixed private binary protocol, override is correct. If it is HTTPS on 9443, create a custom app or use ssl / web-browsing, not override.

Triage order

1. Inspect one session — incomplete vs aged-out.

2. Identify the server and whether the protocol is documented.

3. If it is TLS, allow ssl on that port and decrypt if policy allows.

4. If it is a private protocol, create a custom app or a tight application-override (those IPs, that port).

5. Never override 443 for the whole internet.

Classic traps

What you see	Real cause	Fix
Override the whole zone	One appliance is proprietary	Lock override to IP and port
Allow any	You lost App-ID forever	Use a custom app
It is unknown so it is malware	It is just undecoded	Prove the protocol

Proof the ticket is closed

• Session application is the custom app or ssl

• Threat logs still exist if it is TLS

• Override is scoped to the appliance

Say this in an interview

I treat application-override as turning IPS off for a path. I only do it for a known private protocol.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/