Technical Tip: No replacement message for application control when web filter is applied in proxy mode on same firewall policy
Description
This article describes that when the same firewall policy is applied with application control along with web-filter in a proxy mode no replacement message will be generated for application control.
Application control works only on flow-based and web filters can be proxy or flow-based. Whenthe web filter is proxy-based, the proxy will do SSL inspection, and decoded data will be sent to IPS for application control.
Application control works only on flow-based and web filters can be proxy or flow-based. Whenthe web filter is proxy-based, the proxy will do SSL inspection, and decoded data will be sent to IPS for application control.
Scope
FortiGate.
Solution
Configure web filter in flow-based instead of proxy-based. When the web filter is flow-based, together with AppCtrl, traffic will be processed inside the IPS engine, including SSL inspection.
config webfilter profile
edit <profile name>
set inspection-mode flow-based
end
end
set inspection-mode flow-based
end
end
Note:
The command to change the inspection mode is different in higher versions.
Related article:
Technical Tip: Changing inspection mode
