Application Control with cleanup rule in Firewall policy

[cdooer]

Hello again. Just wondering how the Application Control stuff is supposed to work when there's a cleanup rule at the end of the firewall policy? The traffic gets dropped before it gets a chance to get to the Application Control blade. Am I missing something?

[ShadowPeak.com]

Hello again. Just wondering how the Application Control stuff is supposed to work when there's a cleanup rule at the end of the firewall policy? The traffic gets dropped before it gets a chance to get to the Application Control blade. Am I missing something?

I'm assuming you are referring to R77.30 or earlier management.

The connection that will carry the application data must be explicitly permitted first by the main firewall policy based on IP addresses and port numbers. In the case of TCP, there is no data/payload for APCL/URLF to start looking at via its policy until the TCP 3-way handshake is allowed to complete and data begins to flow.

In R80+ management use of so-called ordered layers retains this basic methodology, and the different blade policies that were represented on different tabs across the top of the R77* SmartDashboard are instead shown as separate policy layers on the left hand side under the "Security Policies" tab of the R80+ SmartConsole.

Unified/inline layers can be used with R80.10+ gateways and have some pretty interesting capabilities, including the ability to explicitly decide if the implied cleanup rule of a policy layer is an Accept or a Drop. Way beyond the scope of this post though. :-)

[cdooer]

Unfortunately that renders the AC blade somewhat useless...in my case anyway. I was hoping to be able get away from the need to track all of the IP's associated with O365.