When you set the application to any and just define a port, it acts like a basic firewall. Not matter what application is being used (DNS/SMTP/Web-Browsing/SSL), it's going to be allowed as long as it's using the defined port/service. Application Override policies bypass the App-ID engine.
An application override policy is used to change the way the firewall classifies network traffic into applications. An application override with a custom application will prevent the session from being processed by the App-ID engine, which is a Layer-7 inspection. The firewall is forced to handle the session as a regular stateful inspection firewall at Layer-4. If an existing application, web-browsing, for example, is used in the application override, the rule will force all matching traffic into Layer-7 inspection for that specific application.
An application override could be used wilth custom internal applications that use non-standard port numbers or internal applications that are classified by the firewall as "unknown" and custom definitions have been created for them.
Application Override and Scanning Engines
... View more
