Overcoming an application filter and url groups

[BobW]

This example is fictitious, but you will get the idea.

I would like to use an application filter to block all "peer to peer".  So I create the necessary filter.  Then I determine that I want to allow one of the items which is defined in the "peer to peer" filter.  Is there some way to overcome/remove the app from the filter?

I hope there is, otherwise I am afraid the filter process might not be very helpful.

While we're at it...How about overcoming URL groups?  Example is I woudl like to allow some of the items in the social networking group but block all Chatroullette type sites.

Thanks,

Bob

[mikand · Accepted solution]

The tricky part is when one object belongs to two groups or more at the same time.

I would then recommend to use the following setup:

1) Blacklist.

2) Whitelist.

3) Default deny (+ log on session end).

For example if one URL belongs to both "malware sites" and "travel sites" at the same time (and malware is blacklisted and travel is whitelisted).

In your case I think you can solve your problem by doing this:

1) Allow specific app.

2) Deny application-filter peer-to-peer.

3) Other rules...

4) Default deny (+ log on session end).

The tricky part is if the app you wish to allow also have a dependency to a much wider app such as web-browsing or unknown in case one of these is part of the applications you wish to block (or not allow).

[BobW]

Thanks for your reply, I guess the bottom lien is tune, tune, tune.  It is a different way of thinking than a typical firewall.

I was also thinking of customizing the risk ratings on the apps down to a lower level, then filter all apps with "risk 5" but am not sure if the customized risk rating would be reset during a future update.

Bob