unidentifiable applications allowed ?

[dieter]

I have a policy (service All) where I want to only allow access to two applications. Although ssl inspection is not an option, Fortigate recognizes those two applications fine.

In the app control profile all application categories and unknown applications are set to block. The two applications I want to allow are added to the overrides with action Monitor. See attached screenshot.

Fortigate however decides to allow other traffic, traffic whose application can not be identified. Is this expected behaviour ?

[maick78]

if ssl inspection is not an option, you should implement ISDB, but this will not work correctly for certain applications.

[dieter]

I understand that application recognition is not flawless, but that does not explain why category Unknown traffic is allowed.

If it's unknown, it would mean it did not find a matching (known) application.

[thomas4]

Did you find a solution to this?