topic Re: Allow application from a blocked category in General Topics

Allow application from a blocked category

GCSS-RT — Thu, 21 Feb 2019 17:44:07 GMT

Hello everyone,

I searched this topic before posting and couldn't find an exact answer so I'm asking the question here.

I have blocked a specific category that includes multiple appplications. I now need to allow one of those applications, but keep the category blocked as it is. Do I just create a new policy just about the blocked category policy and allow the application? If so, do I also need to allow the dependencies it warns me about?

Thank you for any advice that you can share.

Re: Allow application from a blocked category

Raido_Rattameister — Thu, 21 Feb 2019 17:46:59 GMT

You need to create allow policy with this needed application (and dependencies) above block rule.

Re: Allow application from a blocked category

GCSS-RT — Thu, 21 Feb 2019 17:48:34 GMT

Perfect! Thank you.

So, if the dependencies are "web-browsing" and "ssl" and I allow those in that policy...those allowances will not affect other policies already in place, right?

Re: Allow application from a blocked category

Raido_Rattameister — Thu, 21 Feb 2019 17:53:16 GMT

Without knowing your policies it is hard to tell.

Do you allow web-browsing and ssl already?

If yes then you don't need to allow them.

If you block general web-browsing and ssl then you might want to also create custom URL category and use this under "Service/URL category" tab to allow this traffic to specific URLs only.

Re: Allow application from a blocked category

GCSS-RT — Thu, 21 Feb 2019 17:53:56 GMT

Understood.

I do allow web-browsing and ssl already. I was just wondering since the warnings come up when I commit if I don't add those dependencies to that allow rule. I assume I can just ignore those warnings?

Re: Allow application from a blocked category

Raido_Rattameister — Thu, 21 Feb 2019 17:57:00 GMT

Dependency check is not always perfect so yes you can ignore.

Or if you prefer to keep it clean add web-browsing and ssl in the rule so no warning.

You can compare if there is any difference between rule that allows web-browsing and new rule (different zones, source subnets etc). There must me reason why dependency warning comes up.

Re: Allow application from a blocked category

GCSS-RT — Thu, 21 Feb 2019 17:58:51 GMT

Got it. I'll check to verify the differences and move on from there. I appreciate the help.