Allow application from a blocked category

[GCSS-RT]

Hello everyone,

I searched this topic before posting and couldn't find an exact answer so I'm asking the question here.

I have blocked a specific category that includes multiple appplications. I now need to allow one of those applications, but keep the category blocked as it is. Do I just create a new policy just about the blocked category policy and allow the application? If so, do I also need to allow the dependencies it warns me about?

Thank you for any advice that you can share.

[Raido_Rattameister · Accepted solution]

You need to create allow policy with this needed application (and dependencies) above block rule.

[GCSS-RT]

Perfect! Thank you.

So, if the dependencies are "web-browsing" and "ssl" and I allow those in that policy...those allowances will not affect other policies already in place, right?

[Raido_Rattameister]

Without knowing your policies it is hard to tell.

Do you allow web-browsing and ssl already?

If yes then you don't need to allow them.

If you block general web-browsing and ssl then you might want to also create custom URL category and use this under "Service/URL category" tab to allow this traffic to specific URLs only.

[GCSS-RT]

Understood. 

I do allow web-browsing and ssl already. I was just wondering since the warnings come up when I commit if I don't add those dependencies to that allow rule. I assume I can just ignore those warnings?

[Raido_Rattameister]

Dependency check is not always perfect so yes you can ignore.

Or if you prefer to keep it clean add web-browsing and ssl in the rule so no warning.

You can compare if there is any difference between rule that allows web-browsing and new rule (different zones, source subnets etc). There must me reason why dependency warning comes up.

[GCSS-RT]

Got it. I'll check to verify the differences and move on from there. I appreciate the help.