Application Identification

Precise identification of applications on a network is the prerequisite and basis for network services such as intelligent traffic steering, QoS, application optimization, and security. Service policies can be applied in subsequent service processes only after applications are identified.

Application Identification Modes

SD-WAN application identification can be implemented in two modes: first packet identification (FPI) and service awareness (SA), as shown in Figure 2-19.

Figure 2-19 Application identification

• FPI

  FPI can identify the application type at the first data flow of an application. It can quickly identify applications, and is mainly used for SaaS applications with fixed destination addresses or ports.

• SA

  SA performs deep packet analysis and accurately identifies common applications based on the characteristics in application payloads.

When a packet reaches the application identification module, the FPI is performed. If an application can be identified through the first packet, the SA is no longer performed. If the application fails to be identified, the SA is performed.

For the FPI and SA, the FPI signature database and SA signature database are preconfigured on CPEs. The CPEs can identify common applications based on the application definition (port, feature, and behavior) in the signature database. In addition, the FPI and SA also support customized applications, so that users can customize special applications.

Application Scenarios

1. NAT must be configured on the path that the application passes through. If the application cannot be identified, it may be discarded after route selection because NAT is not configured for SYN and ACK packets.
2. As the pervasive use of clouds, customers want to send SaaS and trusted network traffic directly from branches to the Internet instead of forwarding data through the data center. This improves the bandwidth utilization and reduces the transmission delay and costs.
3. When enterprises use their own applications or applications that run on the Internet, the Internet traffic is known and trusted, but other HTTP/HTTPS traffic is unknown or suspicious. If a specific application cannot be identified through the first data packet, all HTTP/HTTPS traffic must be sent to the Internet or sent to the security web gateway or HQ for further check by the enterprise firewall and IDS/IPS resources.

Implementation

FPI is implemented by matching the first packet of a data flow based on 3-tuple information, 5-tuple information, or DSCP values, or based on the domain name or SA cache. Applications are matched based on L3-L4 information of the packet. Therefore, if multiple applications have the same L3-L4 information, the applications may be incorrectly identified. In addition, the FPI process is simple, so the processing performance of FPI is higher than that of SA.

Application Scenarios

The enterprise network uses a router as the egress gateway to connect to the WAN. To ensure network quality and regulate employees' online behaviors, the service awareness technology can be used to identify various applications on the network and control identified application protocols.

Implementation

Signature identification is the basic technology of service awareness. Different applications usually use different protocols that have their distinctive characteristics. These characteristics may be specific ports, specific character strings, or specific bit sequences, and characteristics that can identify a protocol are called characteristic code. Signature identification determines an application by detecting characteristic codes in data packets. Since characteristic codes of some protocols are embedded in multiple packets, characteristics field-based identification must collect multiple packets to identify the protocol type. This technology analyzes service flows passing through a device and compares the analysis result with the signature database loaded to the device. By detecting characteristic codes in data packets, the system can identify applications and implement refined policy control based on the identification result.

The SA signature database is also called the SA signature database. Applications can be identified in predefined application mode or through the SA signature database predefined on the CPE.

• Predefined application mode: Applications are identified based on triplet or keywords. On the CPE, rules can be created through triplet, keywords, or both triplet and keywords. The triplet refers to the server IP address, protocol type, and port number. The keywords are signatures of a data packet or a data flow corresponding to the application and uniquely identify the application.
• SA signature database: Applications are identified based on the SA signature database. The SA signature database can have 500+ or 6000+ records, depending on the device type. The SA signature database can be upgraded through Huawei Security Center Platform. The SA signature database needs to be updated frequently because applications on the live network change rapidly. If the SA signature database is not updated in time, some applications may fail to be identified.