Application Control
Application control is a security technology that prevents unauthorized
applications from damaging data by blocking or restricting their
execution.
It helps administrators to manage access to any applications .
Application control sensors specify what action to take with the
application traffic. Application control uses IPS protocol decoders
that can analyze network traffic to detect application traffic, even if the
traffic uses non-standard ports or protocols.
Why we use Application Control
identifies applications, by matching known patterns with the
application's transmission patterns.
allows or blocks the defined applications that try to access system
resources on a client computer.
control how Firewall behaves toward applications or processes when
they connect to the internet.
prevents unauthorized applications from damaging data by blocking or
restricting their execution.
detects applications that consume a lot of bandwidth.
Application Technology Forms
1) web application
A web application is an application program that is stored on a remote
server and delivered over the internet through a browser interface.
Web apps are delivered over an internet browser. Users don't need to
install them on their devices.
2) Client-server
The user interaction with the server is always through a user
interface or application on the client side.
3) Cloud Application
cloud applications is any software application that is deployed in a
cloud environment .
PEER-TO-PEER
Peer-to-peer network is a network in which interconnected computers
share resources among each other without a centralized administrative
system.
Application Control in FortiGate
FortiGate can recognize network traffic generated by many applications.
The FortiGate unit includes
signatures for over 1000
applications, services, and
protocols.
Application control works
beyond HTTP and HTTPS
web filter inspection.
With application control you
can see that the traffic is not
only going to Facebook, but
that the traffic is for
Facebook messenger,
allowing you to block it if you feel the need to. Or maybe you want to
allow Facebook chatting, but block people sending and receiving files
through Facebook messenger.
Application control provides more flexibility in controlling
access to web-based or other applications.
Application control can be configured in proxy-based and flow-based
firewall policies.
because application control uses the IPS engine, which uses
flow-based inspection, inspection is always flow-based.
Updated and new application signatures are delivered to your FortiGate
as part of your FortiGuard Application Control Service subscription.
The application control database is part of the FortiGuard Intrusion
Protection System Database, and both of these databases have the
same version number.
HOW APP CONTROL WORKS
When applied Application
Control in Client-server
connection.
In client-server architecture.
There may be many clients of
popular sites, but with a file
server, it's just one client and
one server.
client-server is a Traditional
connection that use a One
client to one server connection.
defined protocol over a standard port number. Whether it's from a web
or FTP site, the download is from a single IP address to a single IP
address. So, blocking this is so easy. So, you only need one firewall
policy.
When applied Application Control In peer-to-peer application
the designers made P2P applications able to bypass firewalls and
incredibly hard to detect.
Port randomization and changing encryption patterns are some
of the techniques that P2P protocols use, these techniques make P2P
applications difficult to block using a firewall policy and make them
difficult to detect by proxy-based inspection.
Flow-based inspection using the IPS engine can analyze packets for
pattern matching and then look for patterns to detect P2P applications.
Peer-to-peer (P2P) downloads divide each file among multiple peers.
Each peer delivers part of the file.
While having many clients is a disadvantage in client-server
architecture, it is an advantage for P2P architecture to use multiple
peers because, as the number of peers increases to n, the file is
delivered n times faster.
To solve Problems Like P2P Apps in FortiGate
We use the application control feature that examines the traffic itself
for signatures unique to the application generating it.
FortiGate uses its IPS engine to check for matching signatures and
traffic patterns.
Application control does not require knowledge of any server
addresses or ports. The FortiGate unit includes signatures for
over 1000 applications, services, and protocols.
Application control uses IPS protocol decoders that can be used to
analyze network traffic to detect application traffic even if the traffic
uses non-standard ports or protocols.
log and manage the behavior of application traffic passing through the
FortiGate unit.
The application control signature database information is also displayed on
the FortiGuard page.
You can find the version of the application control database that is installed
on your unit,
Application control requires a subscription to FortiGuard application
control. The database for application control signatures is separate
from the intrusion prevention system (IPS) database.
Application Control in NGFW Modes
Policy-Based
When FortiGate is operating in NGFW policy-based mode,administrators
can apply application control to a security policy directly.
The administrator can select the applications or application categories
they want to allow or deny in the firewall policy.
You can also configure the Group with multiple applications and
application categories.
Profile-Based
QUIC is a protocol from Google. Instead of using the standard TCP
connections for web access, QUIC uses UDP, which is not scanned
by web filtering. Allowing QUIC instructs FortiGate to inspect
Google Chrome packets for a QUIC header and generate logs as
a QUIC message. Blocking QUIC forces Google Chrome to use
HTTP2/TLS1.2 and FortiGate to log QUIC as blocked. The default action
for QUIC is Block.
The Replacement Messages for HTTP-based Applications setting allows
you to replace blocked content with an explanation. However, for nonHTTP/HTTPS applications, you can only drop the packets or reset the TCP
connection.
Applying an application control profile
Block page
Logging and Reporting
https://www.linkedin/ahmed-shawky