Application Sensor not blocking traffic

[riaanwest]

Hi Guys,

I have a firewall rule allowing all ports to all destinations, but I include an application sensor that blocks smtp as an override. When I telnet from a server to an internet host on port 25 the traffic is allowed.

Is there any reason why its is allowed and not blocked as intended to?

Please see screenshot attached.

Your help will be much appreciated.

Thanks

[Nicholas_Doropoulos]

I think the best starting point would be to confirm that the traffic is being matched by the policy you have attached the Application Control profile to. What do the logs say? Have you run a diag sniffer packet?

[hmtay_FTNT]

Hello riaanwest,

What you are doing is blocking the SMTP protocol. The Application Control module identify a session by its payload, not the port number. If you send a Telnet packet on port 25, it will not be identified as SMTP and will be allowed to go through. If you want to block port 25, you just need to create a firewall policy that blocks the port number 25. Thanks.

Homing