Application control for Gaming

[cwb2205]

General question on how a policy needs to be configured to allow gaming.

I need to set up a scheduled policy to allow gaming after core hours. I understand to do this I will need a policy with the schedule set with an application control profile allowing gaming category. 

What I am trying to get my head around is does that policy need to allow the specific ports for those gaming services, eg steam, or just web access to kick off the session and then application control will handle the rest of the port access? If I allow all services with an application control profile, will the application control profile restrict the ports?

Basically how do I allow application access without opening up more ports than needed in the policy.

Hope this all makes sense.

Chris. 

[hubertzw]

Do you have policy where you block it?

Try to find the application on the fortiguard website. If you can find it there, you need just application security profile.  You don't need to configure ports, etc.

[cwb2205]

Thanks hubertzw,

currently on the clients ASA they have a a rule that allows all of the ports for steam games.

I have created an application control profile in the fortigate that allows steam as they have signatures for it. 

Seen as there is no internet service profile for steam or games I will need to assign the application control profile to a policy as you said. What services would I need in that policy for the traffic to match to then apply the application control profile? 

Cheers,

Chris.

[hubertzw]

Are you able to identify the app in the application control logs? Probably you may need SSL full inspection to see the traffic and match the signature. You can create a profile where you monitor all categories. It will permit and generate logs. Once you know if the app is there you can add the policy with time range. With application control you can add own signature if something is missing.

[cwb2205]

Seems that steam sessions are kicked off with HTTPS then the application control allows the rest of the session from there. 

[hubertzw]

Can you show UTM logs?

[Christian_89]

Hi Chris,

Application Control, as you mentioned, is a security feature that you can use to control the applications that users on your network can access. It gives you granular control over application usage, and it can be very helpful in maintaining network security while still allowing necessary services.

When it comes to configuring application control for gaming, there are a couple of key points to consider.

**1. Understanding the Application Control Profile:**

The Application Control Profile identifies the applications that you want to allow or block. In your case, you want to allow gaming applications such as Steam. In this profile, you'll identify the specific applications that you want to allow. Application control systems usually come with predefined profiles for popular applications, so you won't need to configure this from scratch.

**2. Scheduling the Application Control Profile:**

You want to allow gaming after core hours, so you'll need to schedule the application of the Application Control Profile. This is usually done through policy management. You'll create a policy that applies the Application Control Profile according to a certain schedule.

**3. Handling Ports and Services:**

Application control systems generally use Layer 7 (Application Layer) information to identify and control applications, which means they can identify applications regardless of the ports they are using. This can be helpful in situations where applications use dynamic ports or non-standard ports.

Therefore, you don't need to manually specify the ports for each gaming service. The application control system should handle this for you.

However, you should still have a default policy that blocks all unnecessary ports and services. This way, even if an application is allowed by the application control system, it still won't be able to communicate if it's using a blocked port or service. This provides an extra layer of security.

**4. Minimizing Open Ports:**

To minimize the number of open ports, you can use the principle of least privilege. This means only opening the ports that are absolutely necessary for the applications you want to allow.

In summary, you can achieve your goal by creating an Application Control Profile that allows the necessary gaming applications, scheduling this profile to be applied after core hours, and maintaining a default policy that blocks all unnecessary ports and services.

I hope this helps! Let me know if you have any further questions.

[sahmed_FTNT]

You can create a separate policy only allowing the src IP accessing gaming service, then you can allow all the application signatures involved in gaming with logging