@JasonFerris wrote:
Hi Brandon,
Example: traffic from source1 to say internet with specific app IDs like ms-update etc. What I'm after I guess is that when adding apps to the rule you see the depends on - ssl, websocket. But if you don't go and add those to the existing rule its possible that traffic or some of the traffic won't hit that rule for ssl or websocket correct? Hitting a more general rule afterwards or a deny all rule. To make sure that ms-update application traffic works as expected "should" ssl and websocket be applied to that rule? I'm trying to be granular in our rules so only necessary traffic is allowed.
@JasonFerris -- let me clarify what I meant. To account for the "depends-on" like you mentioned. You have 3 options, but really only 2. The 2 I previously mentioned.
1. You can create a general rule that allows the "you should probably allow these applications so web pages can work" rule. These would be App-IDs like web-browsing, stun, websocket, SSL...et al.
2. Or they could be only included in the specific rules associated to their "depends-on" App-ID.
Option 3 is the one you just mentioned is "do nothing with it" let it hit a default deny rule and hope for the best. In some instances not allowing the depends-on App-ID won't really impact the core App-IDs functionality. That particular app may generally be ok with some one-off scenarios where the traffic behaves weird for the user with things not working right. There are other App-IDs where not allowing the depends-on App-ID will me the primary application just won't work.
... View more
