topic App Override - should it be "instant"? Also, SFTP? in General Topics

App Override - should it be "instant"? Also, SFTP?

bradenmcg — Fri, 17 Dec 2010 21:19:55 GMT

I have some stuff that is getting mis-categorized, so I setup app-override rules. After committing the config, if I go over to the ACC tab, should the formerly-uncategorized traffic be automatically put in the right place? Or does the app-override only apply to future traffic after the commit?

Secondly, what is the correct application to catch SFTP (which I believe is similar to cp running inside of an SSH tunnel, as it runs on port 22)? Should I be using the normal SSH app, or is "ssh-tunnel" correct?

Re: App Override - should it be "instant"? Also, SFTP?

jpa — Fri, 17 Dec 2010 22:06:52 GMT

fror the first part -App overide applies to the future traffic that matches the rule

Re: App Override - should it be "instant"? Also, SFTP?

dagibbs — Sun, 19 Dec 2010 23:15:48 GMT

bradenmcg wrote:

The appliance won;t go back through the logs and re-categorise traffic which has already eben passed - that's merely a log entry.

All new traffic which matches your app over-ride will have the over-ride's name instead of the incorrect category.

As far as SFTP goes, I'm pretty sure it's identified by the SSH application ID - yup, just tested it, and it logs as "ssh".

Cheers.