Technical Tip: SD-WAN application control traffic initially hits the less specific rule instead of the rule with application control

In theory, traffic of application 'Microsoft.Outlook.Office.365' should follow rule 1.

However, it is possible that in the traffic log, some traffic also matches the less specific rule 2 ('dst all').

This is because FortiGate needs to learn the application first. Applications must be identified by the IPS engine which implies:

• An Application Control profile must be defined in the firewall policy.
• SSL deep-inspection is required for identification of traffic protected by SSL. 

Before the application is learned, it will follow rule 1.

After the application has been learned (as configured in the firewall policy), SD-WAN can then recognize the application and use rule 1.

Before the application is learned, initial traffic may hit the less specific SD-WAN rule '2' instead of rule '1' (with application control).

config system sdwan

    config service

        edit 1

            set name "rule-app-ctrl"

            set src "all"

            set internet-service enable

            set internet-service-app-ctrl 45553  <- Application 'Microsoft.Outlook.Office.365'.

            set priority-members 1

        next

        edit 2

            set name "rule-all"

            set mode priority

            set dst "all"

            set src "all"

            set health-check "Default_DNS"

            set priority-members 2

        next

end

config firewall policy

    edit 1

        set name "firewall-rule-1"

        set srcintf "port2"

        set dstintf "virtual-wan-link"

        set action accept

        set srcaddr "all"

        set dstaddr "all"

        set schedule "always"

        set service "ALL"

        set utm-status enable

        set ssl-ssh-profile "certificate-inspection"

        set application-list "default"

        set logtraffic all

        set nat enable

    next

end

The following command can be used to check the application control cache learned by SD-WAN.

diagnose sys sdwan internet-service-app-ctrl-list

…

Microsoft.Outlook.Office.365(45553 4294837323): 40.99.10.98 6 443 Tue Feb 22 11:50:55 2022

Application Control profile is required on the initial policy matched:

This is especially relevant if the traffic would initially match a different SD-WAN zone before application detection. Ensure the original firewall policy the traffic would match also has Application Control enabled.

Consider the case where there are 2 default routes via 2 SD-WAN zones. In this example, all traffic should egress via wan1, except for Microsoft Outlook traffic which should use wan2. An SD-WAN rule is configured to with application steering to route this traffic via wan2.

get router info routing-table details 0.0.0.0

Routing table for VRF=0
Routing entry for 0.0.0.0/0

Known via "static", distance 1, metric 0, best

* vrf 0 10.128.202.1, via wan1, origin 2

* vrf 0 192.168.4.99, via wan2, origin 2 

config system sdwan

config members

edit 2

set interface "wan2"

set zone "WAN2-Zone"

set gateway 192.168.4.99

next

edit 1

set interface "wan1"
set zone "WAN1-Zone"
set gateway 10.128.202.1

next

end

config service

edit 2

set name "App-Steering"
set internet-service enable
set internet-service-app-ctrl 15816
set priority-members 2

next

edit 1

set name "Catch-all"
set dst "all"
set priority-members 1

next

end

end

config firewall policy

edit 1

set name "wan2-zone"

set srcintf "internal1"
set dstintf "WAN2-Zone"

set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set application-list "default"

next

edit 2

set name "wan1-zone"

set srcintf "internal1"
set dstintf "WAN1-Zone"

set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set webfilter-profile "default"

next

end

Since the first packet is routed via wan1 and matches a policy which does not have application-list, the SD-WAN rule 'App-Steering' cannot be triggered since the Microsoft.Outlook signature is never detected. With the configuration above, the application steering SD-WAN rule would never be applied, since traffic initially matches the catch-all SD-WAN rule and a firewall policy with no Application Control profile.

To resolve this issue, apply an Application Control profile to the firewall policy initially matching the traffic.

config firewall policy

    edit 2

        set name "wan1-zone"

        set application-list "default"

    next

end