Add Apps to an Application Filter with Policy Optimizer
Table of Contents
Add Apps to an Application Filter with Policy Optimizer
Automate adding App-ID Cloud Engine (ACE) applications
dynamically to Security policy rules using Application Filters.
Add App-IDs from the App-ID Cloud Engine (ACE,
and/or content-provided App-IDs) to new or existing Application
Filters to automate how you control cloud App-IDs in Security policy.
When new ACE App-IDs match an Application Filter, the firewall adds
them to the filter automatically. When you use the Application Filter
in a Security policy rule, the rule automatically controls new ACE
App-IDs as they arrive at the firewall and are added to the filter.
ACE
provides App-IDs for applications that were previously identified
as ssl or web-browsing.
Using Application Filters is
a best practice because they:
- Improve your security posture. Application Filters automate adding new ACE App-IDs to Security policy rules that you design specifically to handle a particular type of application traffic, instead of matching the traffic to more general ssl or web-browsing rules.
- Save time. Firewall administrators can configure Application Filters to handle different types of traffic so that adding new ACE App-IDs to policy is automatic and requires no further effort by the administrator.
When you create Application
Filters, exclude ssl and web-browsing from the filters. Together,
ssl and web-browsing match all browser-based cloud applications,
so an Application Filter that includes ssl and web-browsing matches
all browser-based cloud applications.
Use Policy Optimizer to add
ACE App-IDs to Application Filters and to apply the filters to cloned
or existing rules and control the ACE App-IDs in Security policy.
- Go to and then select .If the firewall has identified traffic with ACE App-IDs, a number displays next toNew App Viewerin the left navigation window. The screen displays the Security policy rules that match cloud App-IDs.
- Click the number inApps Seenfor a Security policy rule to see the cloud-delivered applications that matched the rule in theApplications & Usagedialog.
- Select the applications that you want to add to an existing or new Application Filter.You can sort and filter the applications inApps Seenby subcategory, risk, amount of traffic seen over the last 30 days, or when the application was first or last seen.
- SelectApplication FilterfromCreate Cloned RuleorAdd to Existing Rule, depending on how you want to handle the applications.
![]()
The maximum number of applications you can clone usingCreate Cloned Ruleis 1,000 applications. If there are more than 1,000 applications that you want to move to a different rule, useAdd to Existing Ruleinstead. If you want to move the applications to a new rule, simply create the rule first () and then use Policy Optimizer to add them to that rule. - Select or create the Application Filter for the cloned or existing rule. Creating an Application Filter using Policy Optimizer is the almost exactly the same as using to create an Application Filter—you use the same filtering tools and options.Create Cloned Rule:
- Type theCloned Rule Name(the name for the cloned rule, which will appear in the Security policy rulebase immediately above the original rule).
- Select thePolicy Action(Allow or Deny).
- Select theApplication Filter Namefrom the menu or type the name of a new Application Filter.
- Select whether the filter shouldApply to New App-IDs onlyor if it should apply to all App-IDs.
- Use the Category, Subcategory, Risk, Tags, and Characteristic values to filter the types of applications you want to add to the Application Filter. The firewall automatically adds new applications that meet the filter criteria to the Application Filter.
![]()
- ClickOKto add the applications to the new or existing Application Filter. The firewall includes the applications that you selected in Step 3 in the Application Filter.
- Committhe changes.
Add to Existing Rule:- Select theExisting Rule Nameto add the selected applications to an existing rule in an Application Filter.
- Select theApplication Filter Namefrom the menu or type the name of a new Application Filter.
- Select whether the Application Filter isShared, whether you want toDisable overrideof application characteristics for the filter, and whether the filter shouldApply to New App-IDs onlyor if it should apply to all App-IDs.
- Use the Category, Subcategory, Risk, Tags, and Characteristic values to filter the types of applications you want to add to the Application Filter. The firewall automatically adds new applications that meet the filter criteria to the Application Filter.
![]()
- ClickOKto add the applications to the new or existing Application Filter. The firewall includes the applications that you selected in Step 3 in the Application Filter.
- Committhe changes.
