I've got two VWIRE pairs that see some duplicate traffic.
VWIRE1 sees LAN to Internet
VWIRE2 sees LAN+DMZ to Internet.
What I'd like to do to free up some resources is disable inspection on one of those pairs for traffic when source IP matches a CIDR block. Creating a custom application doesn't work in this case.
Has anyone been able to do this?
Here is the link to disable application inspection on the firewall for certain traffic.
Create two custom applications under Objects>Applications
1 ) For tcp port, select under port :- tcp/dynamic
2) For UDP, select under port :udp/dynamic
Create two separate application override rules , one of tcp and the other for udp traffic.
One security rue will have protocol TCP and ports 0-65535
The other security rule will have protocol UDP and port 0-65535
Let me know if this helps.
You should be able to use an application override policy with a custom application. The application override policy can be defined for a particular source or destination IP range/subnet. Any session which matches the app override policy will be classified as the custom application. This will also disable all layer 7 inspection on that traffic.
The document below gives further details.
Once you create the application over ride rule along with the custom application and commit, you need to clear all the existing sessions from the firewall that uses inbuilt application
>clear session all
>clear session all filter source <x.x.x.x>
Now test the application override rule by sending traffic.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!