topic Re: Application Override in General Topics

Application Override

huntlee — Fri, 23 Sep 2016 03:30:21 GMT

Hi there,

My client has an internal application that doesn't need App-ID (Layer 7) scans for better performance.

When I created the Application Override, under the "Protocols/Application" tab, there are 2 fields, one is Port and the other is Application. I am very confused on these two fields.

Port - Is it saying traffic utilizing my defined port (say TCP 21) will now bypass the App-ID engine? Or is it saying traffic will now be forced operate over TCP port 21? Or is it saying any traffic passing through as TCP 21 will now be classified as my pre-defined custom App (e.g. Say Client_FTP)?

Application - Is it saying traffic matching my pre-defined custom App (e.g. Say Client_FTP) will now bypass the App-ID engine?

I look through many online documentation but all it says is put in port & application, without much explanation.

Appreciated if anyone can shed some light on this.

Cheers,

Hunt

Re: Application Override

jvalentine — Fri, 23 Sep 2016 15:12:36 GMT

An app override policy is very similar to a standard firewall security policy. With firewall policy, you define match criteria (source/dest/app/port/etc.) and if traffic matches the policy, then you get the resulting action (allow/deny).

With application override, you define the match criteria and the firewall will OVERRIDE the detected application. Go to Objects / Applications, and "Add" a new application. You don't need to make layer-7 signatures for this new application, just give it a name and fill out the basics.

Then, in your Application Override policy, you'll define the match criteria:

- source: internal systems

- destination: server1

- port: tcp21

- APPLICATION: (use the new one you just defined)

You don't have to have all tcp/21 traffic overridden... just tcp21 traffic from your internal systems to the specific server.

You will also need to edit your security policy and permit traffic from internal systems to server1 using the newly-defined application on tcp/21.

Re: Application Override

sidalpha2000 — Tue, 22 May 2018 19:09:58 GMT

Which event will happen if an administrator uses an Application Override Policy

Re: Application Override

BPry — Tue, 22 May 2018 20:14:10 GMT

@sidalpha2000,

Can you rephrase your question a little bit. Not sure what you are actually asking here.