AppCtrl basic category filters and overrides

AppCtrl basic category filters and overrides

Once you have created an application sensor, you can define the applications that you want to control. You can add applications and filters using categories, application overrides, and/or filter overrides.

• Categories: Choose groups of signatures based on a category type. l Application overrides: Choose individual applications. l Filter overrides: Select groups of applications and override the application signature settings for them.

Categories

Categories allow you to choose groups of signatures based on a category type.

Applications belonging to the category trigger the action set to the category.

To set category filters in the CLI:

config application list edit {id} config entries edit 1 set category {id}

set log {enable | disable} next

end

next

end

To set category filters in the GUI:

1. Go to Security Profiles > Application Control.
2. Under Categories, left click the icon next to the category name to view a dropdown of actions:

l Allow l Monitor l Block l Quarantine l View signatures

3. Select OK.

Application and filter overrides

To set overrides in the CLI:

config application list     edit {id}

config entries

edit 1 set protocols {0-47} #network protocol ID

set risk {id}

*level Risk, or impact, of allowing traffic from this application to

occur (1 – 5; Low, Elevated, Medium, High, and Critical).

set vendor {0-25}       #vendor ID

set technology {id}

All         All

• Network-Protocol
• Browser-Based
• Client-Server

4           Peer-to-Peer

set behavior {id}

All         All

• Botnet
• Evasive
• Excessive-Bandwidth
• Tunneling

9           Cloud

set popularity {1-5} #Popularity level 1-5

set action {pass | block | reset}

pass    Pass or allow matching traffic.

block   Block or drop matching traffic.

reset   Reset sessions for matching traffic.

set log {enable | disable}

next

end     next end

To set overrides in the GUI:

1. Go to Security Profiles > Application Control.
2. Under the Application and FilterOverrides table, click Create New.
3. To add individual applications:
   1. Select Application as the Type.
   2. Choose an action to be associated with the application.
   3. Select the + button in the Application field and choose the specific applications from the list where app signatures are displayed. Multiple applications may be selected.
   4. Select OK.
4. To add advanced filters:
   1. Create another entry in the Application and FilterOverrides
   2. Select Filter as the Type.
   3. Select Cloud under the behavior section from the Select Entries Matched signatures are shown along the bottom.
   4. Select OK.