Configuring an application sensor
FortiGates can recognize network traffic generated by a large number of applications using application control, which relies on IPS protocol decoders. Application sensors control what action is taken with application traffic.
To configure an application sensor:
-
Go to Security Profiles > Application Control and click Create New.
-
Configure the following settings:
Name
Enter a unique name for the sensor.
Comments
Enter a comment (optional).
Categories
Configure the action to take on groups of signatures based on their category type. Applications belonging to the category trigger the configured action: monitor, allow, block, or quarantine.
See Basic category filters and overrides for more information.
Network Protocol Enforcement
Enable/disable the enforcement of protocols over selected ports.
See Protocol enforcement for more information.
Application and Filter Overrides
Configure multiple applications signatures with a dedicated action for a single sensor. Filters can be added based on the application category, behavior, popularity, protocol, risk, technology, or vendor subtype.
For more information, see
Block applications detected on non-default ports
When enabled:
-
For monitor and allow actions, applications will be blocked if detected on non-default ports (as defined in FortiGuard application signatures).
-
Block actions still block traffic for the application regardless of the port.
See Port enforcement check for more information.
Allow and Log DNS Traffic
Allow and log DNS application protocol signatures.
QUIC
Allowing QUIC instructs the FortiGate to inspect Google Chrome packets for a QUIC header and logs as a QUIC message.
Blocking QUIC forces Google Chrome to use HTTP2/TLS1.2 and the FortiGate logs QUIC as blocked.
Replacement Messages for HTTP-based Applications
Enable/disable replacement messages for blocked applications.
See Replacement messages for information about replacement messages.
-
-
Click OK.