Technical Tip: Blocking known applications using the application control profiles

Blocking VoIP calls on Telegram.

Step 1: Go to Security profiles -> Application Control -> Create New.

Step 2: Go to Application and Filter Overrides.

• Select Create New.
• On the search bar, write Telegram_VoIP.Call.
  
  

Step 3: Select OK to save.

Step 4: Select OK to save.

Step 5: Apply the new profile on a firewall policy together with the SSL deep inspection profile.

Step 6: Make a call on Telegram.

Step 7: Check the logs.

Blocking Telegram.

Step 1: Create an application profile under Security Profile -> Application Control -> Create new.

Step 2: Go to Application and Filter Overrides.

Select Create New and then, on the search bar, enter Telegram.

Step 3: Select OK to save.

Step 4: Select OK to create the new application control profile.

Step 5: Apply the Telegram application profile and deep inspection profile on a firewall policy.

Step 6: Test the Telegram application.

Telegram was blocked successfully, the application is in a loading state permanently.

Logs:

Blocking WhatsApp VoIP calls.

Step 1: Create an application control profile using the WhatsApp object.

Security Profile -> Application Control -> Create New -> Application and Filter Overrides.

Step 2: Select Create New and type WhatsApp on the search bar.

Step 3: Select WhatsApp_Voip.Call and OK.

Select OK again to save the new application control filter.

Step 4: Apply the filter on a Firewall policy.

Apply the Application control profile together with a deep inspection profile.

Select OK to save.

Step 5: Go to WhatsApp and make a call.

The 'Call Failed' message in the chat windows indicates that the call was blocked successfully.

Step 6: Check the Security event logs for the results.

Log & Report -> Security Event -> Application control.

Example configuration in the CLI: 

To create Application and Filter Overrides: 

config application list
    edit "Voip block"
        config entries
            edit 1
                set application 50776
            next

            edit 2
                set application 40698
            next
        end
    next
end

Note: 50776 is the application ID for Telegram_VoIP.Call and 40698 the application ID for WhatsApp_VoIP.Call. To find the application ID, see Technical Tip: How to list the applications or categories and their corresponding number (ID) when configuring Application Control.

To apply the Application Control profile to a firewall policy:

config firewall policy
    edit <policy ID>
        set application-list "VoipAppsBlock"
    next
end