Amer Networks E5Web GUI - Manual (Page 208)

Enabling Application Control
Application Control can be enabled in two ways:
• Specifying applications directly for IP rules or IP policies.
This is the basic way of either allowing or denying the data flows associated with a given
application. This is often used when testing application control since it is simple but does not
provide much flexibility.
• Associating an Application Rule Set with an IP rule or IP policy
This is the recommended method of using application control and provides more flexible
ways to handle the data flows associated with applications. An Application Rule Set is first
created which defines how an application is to be handled, then one or more Application Rule
objects are added to it. The entire rule set is then associated with an IP rule or IP policy object
These two methods of configuring application control and these are examined next.
Associating Directly with IP Rules or IP Policies
IP rules that use application control are created in the following way:
• Create an IP rule or IP policy with a set of filter parameters to identify connections.
• Use an Action of Allow or NAT.
• Enable application control, select the option to use manual configuration and add the
applications that are to be allowed or denied.
If the Deny option is selected but no applications are selected then everything is allowed. If
the Allow option is selected but no applications are selected then nothing will be allowed.
Example 3.26. Specifying an Application Control Policy
This example creates an IP rule to deny connections originating from the lan network which
match the *_groups signature filter. These will include access to sites such as yahoo_groups and
google_groups.
Command-Line Interface
First, the appcontrol command must be used to create a list of the applications we are interested
in.
Device:/> appcontrol -filter -name=*_groups -save_list
This creates a list with a designation of 1. Next, the list is used in an IP rule.
Device:/> add IPRule Action=Allow
SourceInterface=lan
SourceNetwork=lan_net
DestinationInterface=all
DestinationNetwork=all-nets
Service=all_services
AppControl=Yes
AC_AppAction=Deny
AC_Applications=1
Chapter 3: Fundamentals
208