Configuring an application sensor

FortiGates can recognize network traffic generated by a large number of applications using application control, which relies on IPS protocol decoders. Application sensors control what action is taken with application traffic.

To configure an application sensor:

1. Go to Security Profiles > Application Control and click Create New.

2. Configure the following settings:

   Name		Enter a unique name for the sensor.
   Comments		Enter a comment (optional).
   Categories		Configure the action to take on groups of signatures based on their category type. Applications belonging to the category trigger the configured action: monitor, allow, block, or quarantine. See Basic category filters and overrides for more information.
   Network Protocol Enforcement		Enable/disable the enforcement of protocols over selected ports. See Protocol enforcement for more information.
   Application and Filter Overrides		Configure multiple applications signatures with a dedicated action for a single sensor. Filters can be added based on the application category, behavior, popularity, protocol, risk, technology, or vendor subtype. For more information, see Configuring application and filter overrides Matching multiple parameters on application control signatures Blocking applications with custom signatures
   Block applications detected on non-default ports		When enabled: For monitor and allow actions, applications will be blocked if detected on non-default ports (as defined in FortiGuard application signatures). Block actions still block traffic for the application regardless of the port. See Port enforcement check for more information.
   Allow and Log DNS Traffic		The intended behavior is to allow and log DNS traffic. However, to fully enable logging, configure the following: Within the application sensor profile, create a new Application and Filter Overrides entry. Set the Action to Monitor. Search for the DNS application, select it, and click Add Selected. Click OK to save the override, then click OK to save the application sensor profile.
   QUIC		Allowing QUIC instructs the FortiGate to inspect Google Chrome packets for a QUIC header and logs as a QUIC message. Blocking QUIC forces Google Chrome to use HTTP2/TLS1.2 and the FortiGate logs QUIC as blocked.
   Replacement Messages for HTTP-based Applications		Enable/disable replacement messages for blocked applications. See Replacement messages for information about replacement messages.

3. Click OK.