topic Re: Application object or Application/Site with URLs - when to use? in Firewall and Security Management

Re: Application object or Application/Site with URLs - when to use?

PhoneBoy — Wed, 02 Feb 2022 06:23:00 GMT

If we have an Updatable Object for the relevant service, then that’s probably the better approach.
Otherwise it depends on the precise application.
Note that some application definitions work better with HTTPS Inspection enabled.

Re: Application object or Application/Site with URLs - when to use?

David_C1 — Wed, 02 Feb 2022 18:31:29 GMT

Thanks Dameon,

I assume when you say "Updatable Object", you mean "Applications":

Or do you really mean "Updatable Objects":

My question was about Applications vs. Custom Application/Site with URLs.

I do have https inspection, so we are covered there.

Thanks,

Dave

Re: Application object or Application/Site with URLs - when to use?

K_montalvo — Wed, 02 Feb 2022 19:21:38 GMT

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk131852

Re: Application object or Application/Site with URLs - when to use?

David_C1 — Wed, 02 Feb 2022 22:03:12 GMT

Maybe to make it very clear what I am asking, consider these two rules (in a test policy). The first rule has the Application "ShareFile" as the allowed Services & Applications. The second rule has an Application/Site group (also named "ShareFile") witha list of various URLs as the allowed Services & Applications.

Have people found one method more reliable than the other? I for one have experienced using the Application does not always capture/recognize all of the traffic you think it should. Is one method less resource intensive on the gateway?

Dave