08-24-2016 08:53 PM
I have a policy from trust to untrust any any allowed. I have cloned this policy and put on top of this with address -test and deny 2 applications. This address is an ip for eg. 192.168.1.26 which is reserved in dhcp. But I can see apps being access via any any policy. Should the address be blocked using block policy.
08-24-2016 11:18 PM
Most likely not all conditions were met in the 1st policy, so traffic passed through the any any.
Did you check detailed logs from any any to see why it didn't match 1st policy ( sorce ip, destination , postrs, )?
08-25-2016 08:27 AM
Is this a web applicaion and do you use SSL decyrption? If you are not using SSL decyption and are attempting to block two app-ids it's pretty common for this to not actually work.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!