topic Custom Application by destination address / port combination? in General Topics

Custom Application by destination address / port combination?

Alex_Weldon — Wed, 11 Apr 2018 13:37:22 GMT

Hi - R77.30

Using custom applications, I don't see a way to identify an application by destination address and port combination. Is this not currently supported in R77.30 / App control signature tool? I see there are various other ways to define but none that fit this particular case.

Re: Custom Application by destination address / port combination?

G_W_Albrecht — Thu, 12 Apr 2018 12:20:36 GMT

In R77.30 App Control this can be defined very easily:

- Application & URL Filtering > Applications/Sites > New

- type name for App (mySpecialSite) and click Next

- type IP (172.27.39.198:8080), click Add and click Next

- select Additional Categories and click Next

- click Finish

- use App in policy

Re: Custom Application by destination address / port combination?

Alex_Weldon — Thu, 12 Apr 2018 12:23:25 GMT

Thanks for that, what about an address range? 172.27.39.0/24 lets say.

Re: Custom Application by destination address / port combination?

G_W_Albrecht — Thu, 12 Apr 2018 13:43:33 GMT

An address range is no site.

Re: Custom Application by destination address / port combination?

G_W_Albrecht — Thu, 12 Apr 2018 13:49:19 GMT

...but you could try a regular expression instead !

Re: Custom Application by destination address / port combination?

Alex_Weldon — Thu, 12 Apr 2018 14:27:52 GMT

Thanks, yeah I wasn't quite sure how to best address it. We have a few applications that reach out to a variety of address ranges with a defined port. But, they always show as unknown traffic wasn't sure if there was a solution for it in 77.30. Thank you for the suggestions though.

Re: Custom Application by destination address / port combination?

Victor_MR — Sat, 21 Apr 2018 16:17:28 GMT

However, I'm wondering if you would not prefer to just use a regular firewall rule for this (also full accelerated traffic) instead of an Application Control rule with just layer 4 information.

🙂

Re: Custom Application by destination address / port combination?

PhoneBoy — Sun, 22 Apr 2018 04:55:13 GMT

The "Services" column is hidden in the R77.30 App Control rulebase but can be shown by right-clicking on the section headings in the rule and selecting Service.

Now you can restrict the ports for any App Control rule, if you desire.

Re: Custom Application by destination address / port combination?

Alex_Weldon — Mon, 23 Apr 2018 12:13:48 GMT

Thanks everyone for the suggestions. The rule is defined on the firewall side already with defined source, destination, and services. The issue I am trying to resolve is on the app control/url filtering side of things, all of the allowed known traffic is categorized as "Unknown Traffic" So we can sometimes have 1-2 gigs of "Unknown Traffic" even though it is a known and defined application which is what we were hoping we could define. I reached out to TAC who said they could create a custom application based on packet captures so I will provide them and see how it goes.