Basic category filters and overrides

Once you have created an application sensor, you can define the applications that you want to control. You can add applications and filters using categories, application overrides, and/or filter overrides with designated actions (monitor, allow, block, or quarantine).

Configuring category filters

Categories allow you to choose groups of signatures based on a category type. Applications belonging to the category trigger the action that is set for the category. For a list of application control categories, refer to the FortiGuard Labs website.

To configure category filters in the GUI:

1. Go to Security Profiles > Application Control and click Create New, or edit an existing sensor.
2. Under Categories, click the icon next to the category name to set the action or view the application signatures.

   

3. Click OK.

To configure category filters in the CLI:

config application list
    edit <name>
        config entries
            edit <id>
                set category <id>
                set action {pass | block | reset}
                set log {enable | disable}
            next
        end
    next
end

Configuring application and filter overrides

Multiple application signatures can be added for one sensor with a designated action. Filters can be added based on behavior, application category, popularity, protocol, risk, technology, or vendor subtypes.

To configure overrides in the GUI:

1. Go to Security Profiles > Application Control and click Create New, or edit an existing sensor.
2. In the Application and Filter Overrides table, click Create New.
3. Add an application:
   1. For Type, select Application.
   2. Select an Action from the dropdown.
   3. In the Search box, enter an application name and press Enter.
   4. In the search results, select desired the applications (you can select multiple applications) and click Add Selected.

      

   5. Click OK.
4. Add a filter:
   1. In the Application and Filter Overrides table, click Create New.
   2. For Type, select Filter.
   3. Select an Action from the dropdown.
   4. In the Filter field, click the + . The Select Entries pane opens, and you can search based on filter subtypes. This example has excessive bandwidth (under behavior) and game (under application category).

      

   5. Click OK.
5. Click OK.

To configure overrides in the CLI:

config application list
    edit <name>
        config entries
            edit <id>
                set protocols <integer>
                set risk <integer>
                set vendor <id>
                set technology <id>
                set behavior <id>
                set popularity <integer>
                set action {pass | block | reset}
                set log {enable | disable}
            next
        end
    next
end

protocols <integer>	Application protocol filter (0 - 47, or all).
risk <integer>	Risk or impact of allowing traffic from this application to occur (1 - 5; low (1), elevated (2), medium (3), high (4), and critical (5)).
vendor <id>	Application vendor filter (0 - 25, or all).
technology <id>	Application technology filter: all 0 (network-protocol) 1 (browser-based) 2 (client-server) 4 (peer-to-peer)
behavior <id>	Application behavior filter: all 2 (botnet) 3 (evasive) 5 (excessive bandwidth) 6 (tunneling) 9 (cloud)
popularity <integer>	Application popularity filter (1 - 5, from least to most popular).
action {pass | block | reset}	Pass/block traffic or reset the connection for traffic from this application (default = block).
log {enable | disable}	Enable/disable logging for this application list (default = enable).