Using application control for incoming rules

[mikt]

Hello,

it may just be a silly question - but can i or i can i not use application control for incoming policies?

my rule is:

all (Wan) -> Server (DMZ) > always > all > HTTPS.Browser

and thought it will block all access but HTTPS request. 

A look in the log tells shows me that everything is accepted.

Why is it like that? Why are non https requests are not blocked?

Thanks 

[Dave_Hall]

Application Control is mainly used to control/restrict access to applications by your internal users, usually meaning it is applied to a firewall rule governing traffic from internal (lan) going out (WAN).

If you have an internal web server on the DMZ, it might already be or what you want is setup similar to what is outlined in this link http://cookbook.fortinet....eb-server-with-dmz-54/

But to help us to better understand what you are trying to do is describe your network and server setup.

[Nicholas_Doropoulos]

It's probably worth looking at implementing WAF if it's a public-facing server you want to protect.