Webfilter (licensed) vs Application Control

[rb400]

Re: Webfilter (licensed) vs Application Control

Which process looks at the packet first, app control or webfilter.

If webfilter, and webfilter exempts a url, will the packet bypass the app control process?

Is there any known specific doc on this topic?

Thanks.

[Dave_Hall · Accepted solution]

See Life of a Packet.  Link is from the FortiOS 5.2 Handbook.

[Dave_Hall · Accepted solution]

See Life of a Packet.  Link is from the FortiOS 5.2 Handbook.

[Christopher_McMullan · Accepted solution]

Historically, at least, IPS and App Control were applied before Web Filter profiles, since they are both flow-based.

So a good example would have a been a case where an administrator applied an App Control sensor to block Facebook, but also blocked the Social Networking category in a web filter. The app would be blocked, but the user would not see a replacement message (which would have been generated in the case of a proxy-based WF profile).

Exempting a site in a WF profile in this case would not affect IPS or App Control, since they would have already been checked.