Control Access to Applications
App-ID
App-ID classifies traffic by signature, protocol and behaviour rather than by port, so you can allow a sanctioned SaaS app while blocking an anonymiser on the same port 443. Applications are referenced individually, through application filters (dynamic, attribute-based such as category, subcategory, technology, risk) or application groups (static lists). Some applications have dependencies: related applications must be permitted for the primary app to work, and PAN-OS permits the dependency implicitly when the parent is allowed. Confusing an implicit dependency with an explicit permit is a standard trick. Traffic that cannot be identified appears as unknown-tcp, unknown-udp or insufficient-data; encrypted traffic without decryption usually resolves only to 'ssl', which is why decryption is described as a prerequisite for granular App-ID.
Content-ID and decryption
Content-ID profiles scan allowed sessions: Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis, DNS Security, Data Filtering and SaaS Security. They attach through a Security Profile Group on an allow rule; a profile on a deny rule never runs. SSL forward proxy decrypts outbound sessions using a forward trust certificate; inbound inspection decrypts server-side; SSH proxy covers SSH. Decryption exceptions protect sensitive categories such as health and finance.
Application override
Application override forces a custom application definition onto specific ports and bypasses App-ID for that traffic. It is a deliberate exception, not a performance feature.
Worked example: users reach a video site over HTTPS and logs show only 'ssl'. After enabling SSL forward proxy with exceptions, the same session resolves to the correct application and URL category, so granular policy and threat inspection apply.