Technical Tip: Scanning order for application control

An Application control (IPS engine) on FortiGate inspects incoming traffic for signature-matching.

The one scans the traffic for matches in the following order for the application control profile:

1. Application and filter overrides: The application control profile considers those first if any application overrides or filter overrides were configured. The inspection order is operated to scan top to bottom like the Firewall policy.
   
   
2. Categories: Finally, the application control profile applies actions configured before in the category selected by inspection.
   
   

Example:

In the Application and Filter Overrides section, specific exceptions are configured to override the default category actions.
Although the Game and Video/Audio categories are set to Block, the applications Battle.Net and Dailymotion are explicitly overridden with the action Monitor. Since application overrides are evaluated first during application control scanning, these applications are allowed to pass and generate log entries.

The filter override has been moved above the application override. In this scenario, the filter override (Excessive-Bandwidth) is blocked and, since Dailymotion falls under the excessive bandwidth category, Dailymotion is blocked even though it is set to Monitor under the Application and Filter Overrides section.

Note: It would help to consider other scans like web filtering, although an Application control is done.
This is because, even if the application control decides the traffic is allowed, web filtering may still block it.