Application Policies

For instructions on configuring application control policies, refer to Creating an Application Control Policy.

Configuring application control policies allows the administrator to deny application access by blocking any HTTP host name (Fully Qualified Domain Name [FQDN]) or Layer 4 port. Using application denial policies, administrators can block specific applications if they are seen to be consuming excessive network resources, or enforce network usage policies such as blocking social media sites.

When defining application control policies, you must consider the following FQDN constructions depending on the desired rule actions:

  • "www.corporate.com": Blocks access to the host web server at the organization "corporate.com", that is, the FQDN. It will not block access to any other hosts such as FTP, NTP, SMTP, and so on at the organization "corporate.com".
  • "corporate.com": Blocks access to all hosts at the domain "corporate.com", that is, it will block access to www.corporate.com, ftp.corporate.com, smtp.corporate.com, and so on.
  • "corporate": Blocks access to any FQDN containing the text "corporate" in any part of the FQDN. Care should be taken to use a string that is as long as possible for matching to prevent inadvertently blocking sites that may contain a shorter string match; for example, if the rule is "net", then this will block access to any sites that have the text "net" in any part of the FQDN or ".net" as the FQDN suffix.
  • "*.corporate.com": An invalid rule. The "*" wildcard and other regular expressions cannot be used in any part of the FQDN.
  • "www.corporate.com/games": An invalid rule. The filter cannot parse and block access on text after the FQDN; in this example, it cannot filter the microsite "/games".
Note: Many global organizations have both a ".com" suffix and a country-specific suffix, such as ".co.uk", ".fr", ".au", and so on. For example, to block access to the host web server in all regional-specific web sites for an organization, a rule such as "www.corporate" could be used.
Note: Many global organizations use distributed content delivery networks, such as Akamai. In such cases, creating a rule such as "www.corporate.com" may not prevent access to the entire site. Further investigation of the content network behavior may need to be undertaken to fully prevent access.
Note: When using port-based rules, there is no distinction between the TCP and UDP protocols, so care should be taken if you want to block a specific application por because the rules will apply to both IP protocols and may inadvertently block another application using the other protocol.

In this section:

  1. Creating an Application Control Policy
    Application control policies can be used to block access to certain applications, to rate limit traffic identified as belonging to certain applications, or to perform QoS traffic shaping on traffic identified as belonging to a certain application.
Parent topic: Access Control Settings