About sberti

Hi Eric, I'm afraid you might be out of luck here. One of the many differences between DNS and HTTP is that the first one is 1 packet in each direction. This means in your case you won't be able to have the custom app matched unless DNS as a parent application is allowed but if you do this all DNS requests will be allowed through not just the one you specify in your customer app. Let's assume you create your custom_dns application where www.hp.com is detected and allow it in a policy from A(client) to B (dns server). Now, if the default dns application is denied as soon as the firewall detects that this is a DNS request (It does it before the content is inspected) the request will be denied. Application has been detected as dns and there is an deny action associated wit it On the other hand if the default dns application is allowed when the traffic goes through the firewall the application will shift from dns (the default one) to the custom_dns as soon as the firewall reads the content. So in the logs you'll see a correct match with the custom_dns app you created but being this the mechanism this implies all other dns requests will be allowed as well. . Hope this helps to understand the logic. -Salvo ... View more