| Protect | 150
The device is shipped with a set of predefined applications. These applications are classified based on their risk level, characteristics and technology, offering more granular controls.
The total number of application signatures included depends on the Application Signatures Database used by the device.
The application list can be filtered based on name of the application, category of the application, risk, characteristics, and technology.
Application Filter
This page displays a list of all the predefined and custom policies.
An Application Filter Policy controls a user’s application access. It specifies which user has access to which applications and allows you to define powerful security policies based on almost limitless policy parameters like:
• Individual users
• Groups of users
• Time of day
The device is shipped with the following predefined policies for application filters to address common use cases:
• Allow All: By default, allows access to all the categories except the specified categories. Access to the specified categories depends on the strategy defined for each category.
• Deny All: By default, denies access to all the categories except the specified categories. Access to the specified categories depends on the strategy defined for each category.
• Block filter avoidance apps: Drops traffic from applications that tunnel other applications, proxy and tunnel applications, and from applications that can bypass firewall policy. These applications allow users to anonymously browse the Internet by connecting to servers on the Internet via encrypted SSL tunnels. This, in turn, enables users to bypass network security measures.
• Block generally unwanted apps: Drops generally unwanted application traffic. This includes applications such as file transfer, proxy & tunnel, risk prone, peer to peer networking (P2P) and applications that cause loss of productivity.
• Block high risk (Risk Level 4 and 5) apps: Drops traffic from applications that are classified under 'high risk' applications (Risk Level- 4 and 5).
• Block peer to peer (P2P) networking apps: Drops traffic from applications that are categorized as P2P applications. P2P could be a mechanism for distributing Bots, Spywares, Adware, Trojans, Rootkits, Worms and other types of malwares. It is generally advised to have P2P applications blocked in your network.
• Block very high risk (Risk Level 5) apps: Drops traffic from applications that are classified under 'very high risk' applications (Risk Level- 5).
These predefined policies are immediately available for use. You can also define custom policies to specify different levels of access for different users to meet your organization’s requirements.
The page also provides options to add a new policy, update the parameters of an existing policy, delete a policy, add a filtering rule to a policy, or delete a filtering rule attached to a policy.
Note: You cannot edit/delete Allow All and Deny All predefined policies.
Add Application Filter Policy
This page lets you configure custom policies to define different levels of access for different users to meet your organization’s requirements.
The Add page allows you to manually configure policies.
1. Go to Protect > Applications > Application Filter and click Add.
2. Enter the Application Filter Policy details.
Name
Enter a name to identify the Application Filter Policy.
Description
Enter description for the Application Filter Policy.
Enable Micro App Discovery
Enable to scan and classify microapps using HTTP protocol for communication. Microapps are applications that are used withing web browsers.
To allow/deny microapps, you need to specify action accordingly.
Refer Appendix D - Supported Micro-Apps for more details on supported applications.
Template
Select template for the Application Filter Policy.
| Protect | 151
Figure 157: Application Filter
3. Click Save.
4. Once the policy is added, next step is to add a rule for configuring filtering criteria.
Note:
• Rules can be added for custom policies only.
• If Micro App Discovery is enabled, one has to import SSL CA to avoid Certificate error.
Add Application Filter Policy Rules
Use the Add Application Filter Policy Rules page to configure a new rule for Application Filter Policy.
The Add Application Filter Policy Rules page allows you to manually configure a new rule.
1.
Go to Protect > Applications > Application Filter and click .
2. Click Add under Application Filter Policy.
3. Enter the application filter details.
Category
Select Application Category from the list of available categories.
Risk
Select the level of risk from the available options.Select All1 - VERY LOW 2 - LOW3 - MEDIUM
4 - HIGH5 - VERY HIGH
Characteristics
Select the characteristics from the available options.Select AllExcessive BandwidthProne to misuseTransfer filesTunnels other appsVulnerabilities Widely usedLoss of productivityCan bypass firewall policy
Technology
Select the technology from the available options.Select AllBrowser BasedClient ServerNetwork
ProtocolP2P
Figure 158: Application Filter Criteria
4. Enter the list of matching applications.
Select All
Click to select all the Applications from the list.
Applications are available based on the Application Filter Criteria.
Select Individual Application
Click to select the Applications from the list.
Applications are available based on the Application Filter Criteria.
Search
Specify the name of the application in the textbox to be searched.
This option is available, only if option "Select Individual Application" is selected.
Name
Displays name of the Applications under the Category selected. You can also select more than one application using the checkbox.
Description
Displays description of the Application.
Category
Displays category of the Application.
Risk
Displays the risk factor involved with the Application.
| Protect | 152
