custom mail app-id

[klokholm]

hi. 

I'am trying to create a custom mail app-id filter, for matching; to whom mail is gonging to and from what domain.

I have add smtp as a parent application in the app-id.

My app-id is matching the helo, mail from, rcp, data. from the mail. The policy with this custom app-id is partial match, if I only has this, the data is dropt. 

If I add a new policy row with application smtp below my custom app-id, the first package that came in match smtp, and all blowing data is matching my custom app-id. 

the row application smtp, is becuse to make this policy working i hade to add smtp in the rule, the problem to do so is that it also match evry smtp packaged that comes in to the firewall.

Have i missed somthing? or how can I solve this?

/Kristofer