App Override - should it be "instant"? Also, SFTP?

[bradenmcg]

I have some stuff that is getting mis-categorized, so I setup app-override rules.  After committing the config, if I go over to the ACC tab, should the formerly-uncategorized traffic be automatically put in the right place?  Or does the app-override only apply to future traffic after the commit?

Secondly, what is the correct application to catch SFTP (which I believe is similar to cp running inside of an SSH tunnel, as it runs on port 22)?  Should I be using the normal SSH app, or is "ssh-tunnel" correct?

[jpa]

fror the first part -App overide applies to the future traffic that matches the rule

[dagibbs]

bradenmcg wrote:
I have some stuff that is getting mis-categorized, so I setup app-override rules.  After committing the config, if I go over to the ACC tab, should the formerly-uncategorized traffic be automatically put in the right place?  Or does the app-override only apply to future traffic after the commit?
Secondly, what is the correct application to catch SFTP (which I believe is similar to cp running inside of an SSH tunnel, as it runs on port 22)?  Should I be using the normal SSH app, or is "ssh-tunnel" correct?

The appliance won;t go back through the logs and re-categorise traffic which has already eben passed - that's merely a log entry.

All new traffic which matches your app over-ride will have the over-ride's name instead of the incorrect category.

As far as SFTP goes, I'm pretty sure it's identified by the SSH application ID - yup, just tested it, and it logs as "ssh".

Cheers.