topic Re: Facebook working as application reddit-base in Next-Generation Firewall Discussions

Facebook working as application reddit-base

Jagdeep1 — Wed, 19 Mar 2025 21:27:58 GMT

We are currently experiencing an issue with URL filtering and application-based policies. We’ve set up a policy to block the Facebook application, but it’s still being allowed through. In the logs, it shows as the application "Application reddit-base" instead of Facebook.

When we remove the block rule, Facebook-related apps function normally, but when the rule is applied, it allows the traffic as the "reddit-base" application and hits a different rule.

Has anyone encountered a similar issue? We’ve tried both the latest and previous app-IDs and even rolled back, but the issue persists.

Any suggestions or insights would be greatly appreciated!

Re: Facebook working as application reddit-base

S.Cantwell — Wed, 23 Apr 2025 17:12:43 GMT

Good Day

Thanks for your message.

As more web-based applications are developed and refined, the useage of SSL forward proxy decryption rules may be needed.
For example, the FW can easily recognize facebook-base, however of the 10 to 15 sub/child applications under facebook (facebook-post, facebook-chat, facebook-video, facebook-filesharing, etc), these applications may not be seen, as the traffic is still encapsulated packet. This would be why certain FB applications would still be allowed.

As for facebook-base showing up as reddit-base, certainly does not sound correct for a L7 application signature based firewall.

You may want to consider opening a TAC case, so they can review/revise the application signatures as needed.