Application dependency Warning

[Farzana]

Hello,

We implemented the blocking policy for the custom URL categories however now once committed we receive commit warning like the following:

Application 'dropbox-base' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block'

Application 'google-drive-web' requires 'google-base' be allowed, but 'google-base' is denied in Rule 'outbound-advertisement-block'

The policies for Dropbox and Google drive are policy 14 and 19, and the advertisement block is 53.

Why would the allow policies above the deny policy be generating warning?

We have other deny policies and they do not generate the warning messages.

It’s just that we can’t really have the following showing every time we commit a change. It will blind us to actual issues...?

vsys1: Rule 'outbound ms-update' application dependency warning:

Application 'ms-update' requires 'ssl' be allowed

vsys1: Rule 'outbound_dropbox' application dependency warning:

Application 'dropbox-base' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-uploading' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-paper' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-paper' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-downloading' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-sharing' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-editing' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block'

Application 'dropbox-posting' requires 'ssl' be allowed, but 'ssl' is denied in Rule 'outbound-advertisement-block'

vsys1: Rule 'Google Drive Access' application dependency warning:

Application 'google-drive-web' requires 'google-base' be allowed, but 'google-base' is denied in Rule 'outbound-advertisement-block'

Application 'google-drive-web' requires 'google-docs-base' be allowed, but 'google-docs-base' is denied in Rule 'outbound-advertisement-block'

Application 'google-drive-web' requires 'google-docs-editing' be allowed, but 'google-docs-editing' is denied in Rule 'outbound-advertisement-block'

Application 'google-drive-web' requires 'google-docs-uploading' be allowed, but 'google-docs-uploading' is denied in Rule 'outbound-advertisement-block'

vsys1: Rule 'Video Streaming RTMP Pull' application dependency warning:

Application 'rtmpt' requires 'web-browsing' be allowed, but 'web-browsing' is denied in Rule 'outbound-advertisement-block'

(Module: device)

Thanks in advance.

[reaper · Accepted solution]

did you create the 'outbound-advertisement-block' policy so the custom category is in the service/url category tab?

you could also block this category in a url filtering profile, which would make it possible for you to have an allow policy for web-browsing and ssl

alternatively you could set the applications for your block rule to 'any' 

the google drive and dropbox policies are generating warnings because they need a functioning web-browsing/ssl policy as these apps depend on having access to these before theyre able to be identified. 

[OtakarKlier]

Hello @Farzana,

I get a ton of these as well. It seems that unless the dependencies are in the same policy, it will throw the warnings. I havent found a good way around it and honestly just treat it as a norm :(.

Regards,

[tshooter]

I create a rule called dropbox-allow, I add app id - dropbox, and web-browsing(so it doesn't complain). 

1. question:  if I dont add the dependent app, to the rule, will the rule work and allow traffic?  Or will dropbox fail?  What is consequence ? 


2.If I wanted to block all web-browsing. but allow dropbox, how would I do that? 
Would I create rule to block all web-browsing above rule dropbox allow??

[reaper]

Web-browsing doesn't need to be in the same rule but it needs to be allowed somewhere

This is because the way app-id works:

-Syn packet arrives, security rules are checked for source/dest zone/ip and dest-port

- if matching rule is found, session is created and packets are allowed to pass

-once some packets have passed identifiable payload will pass, like a HTTP GET or a client hello. App-id can now identify web-browsing or ssl or some other parent apps

- once more packets have passed, more specific payload may change the app into something more specific

If you block the parent/dependency app, you will never get to the child app

If you need to block all web-browsing, you can do so by adding web-browsing to the dropbox rule, or creating a new rule with web-browsing, but setting the url category (in the services tab, not url filtering) to a custom category with the dropbox urls included

[tshooter]

Is a URL-filter license required to do that?

[reaper]

@tshootercustom URL categories don't require a URL filtering license!