topic Is is possible to have ACC assign different APP RISK based on the zone? in General Topics

Is is possible to have ACC assign different APP RISK based on the zone?

Steve_Ellis_KPMG — Wed, 11 Jan 2017 14:42:42 GMT

I would like to be able to assign a different RISK rating on the same app, say RDP.

If RDP is seen on the management zone I would rate that as a RISK 2, however if seen on the Internal zone I would rate that as RISK 5. Does anyone know a way to do this short of having different firewalls for each zone?

Re: Is is possible to have ACC assign different APP RISK based on the zone?

BPry — Wed, 11 Jan 2017 15:15:49 GMT

You could create a custom applicaiton for RDP traffic for one of those zones and then utilize an applicaiton override policy for labeling all rdp traffic from the internal zone as the new 'rdp-risk5' application. It's admitably a pretty 'hack' way of doing things, but it'll work for what you are trying to do.

Re: Is is possible to have ACC assign different APP RISK based on the zone?

OtakarKlier — Wed, 11 Jan 2017 22:47:54 GMT

Hello,

Yes you adjust the 'risk' value to something other than default. Go to Objects->Applications, then click on the name of the application. When the popup opens, there is a 'Customize' option next to the default Risk value.

Hope this helps.

Re: Is is possible to have ACC assign different APP RISK based on the zone?

reaper — Thu, 12 Jan 2017 14:08:28 GMT

you want to hit 2 birds with one stone, you could split everyday traffic from management segment by splitting up the two into 2 separate VSYS

in each vsys you can perfectly assign different risk factors to the same application and you get to physically treat the connections differently as they flow through a separate vsys (no risk of accidental overflow)