Basic category filters and overrides

When creating an application sensor, you can define the applications that you want to control. You can add applications and filters using categories, application overrides, and/or filter overrides with designated actions (monitor, allow, block, or quarantine).

Action	Description
Monitor	Passes the traffic and generates a log message.
Allow	Passes the traffic but does not generate a log message.
Block	Drops the detected traffic and generates a log message.
Quarantine	Blocks the traffic from an attacker IP address until the expiration time is reached and generates a log message.

For more information about application control logs, see Security Events log page.

To configure category filters in the GUI:

1. Go to Security Profiles > Application Control and click Create New, or edit an existing sensor.

2. Under Categories, click the icon next to the category name to set the action or view the application signatures.

   

3. If you select the Quarantine action, the Quarantine Duration pane will open. Enter the duration values and click OK.

   

4. Click OK.

To configure category filters in the CLI:

config application list
    edit <name>
        config entries
            edit <id>
                set category <id>
                set action {pass | block | reset}
                set quarantine {none | attacker}
                set quarantine-expiry <###d##h##m>
                set log {enable | disable}
            next
        end
    next
end

Configuring application and filter overrides

Multiple application signatures can be added for one sensor with a designated action. Filters can be added based on behavior, application category, popularity, protocol, risk, technology, or vendor subtypes.

To configure overrides in the GUI:

1. Go to Security Profiles > Application Control and click Create New, or edit an existing sensor.

2. Add an application:

   1. In the Application and Filter Overrides table, click Create New.

   2. For Type, select Application.

   3. Select an Action from the dropdown.

   4. In the Search box, enter an application name and press Enter, or click the plus icon and configure a search filter.

   5. In the search results, select the required applications (you can select multiple applications).

      

   6. Click OK.

3. Add a filter:

   1. In the Application and Filter Overrides table, click Create New.

   2. For Type, select Filter.

   3. Select an Action from the dropdown.

      If the action is set to Quarantine, set the duration of the quarantine.

   4. In the Filter field, click the + . The Select Entries pane opens, and you can search based on filter subtypes. This example uses Browser-Based (under Technology) and Game (under Category).

      

   5. Click OK.

4. Click OK.

To configure overrides in the CLI:

config application list
    edit <name>
        config entries
            edit <id>
                set protocols <integer>
                set risk <integer>
                set vendor <id>
                set technology <id>
                set behavior <id>
                set popularity <integer>
                set action {pass | block | reset}
                set quarantine {none | attacker}
                set log {enable | disable}
            next
        end
    next
end

protocols <integer>	Application protocol filter (0 - 47, or all).
risk <integer>	Risk or impact of allowing traffic from this application to occur (1 - 5; low (1), elevated (2), medium (3), high (4), and critical (5)).
vendor <id>	Application vendor filter (0 - 25, or all).
technology <id>	Application technology filter: all 0 (network-protocol) 1 (browser-based) 2 (client-server) 4 (peer-to-peer)
behavior <id>	Application behavior filter: all 2 (botnet) 3 (evasive) 5 (excessive bandwidth) 6 (tunneling) 9 (cloud)
popularity <integer>	Application popularity filter (1 - 5, from least to most popular).
action {pass | block | reset}	Pass/block traffic or reset the connection for traffic from this application (default = block).
quarantine {none | attacker}	Set the quarantine method: none: Quarantine is disabled. attacker: Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.
log {enable | disable}	Enable/disable logging for this application list (default = enable).

For more information, see the FortiOS CLI reference.