Control application usage

Block web-based applications, particularly anonymizers or proxies, by creating access control rules that identify and restrict traffic based on application attributes

Enterprise networks increasingly rely on web-based delivery platforms and rich media applications, often using the same web protocols. Firewall Threat Defense inspects connections to determine the application, enabling access control rules targeting applications rather than just targeting specific TCP/UDP ports.

Although you can select specific applications to allow or block, you can also write rules based on type, category, tag, risk, or business relevance. For example, you could create an access control rule that identifies and blocks all high risk, low business relevance applications. If a user attempts to use one of those applications, the session is blocked.

Cisco frequently updates and adds additional application detectors via system and vulnerability database (VDB) updates. Thus, a rule blocking high risk applications can automatically apply to new applications without you having to update the rule manually.

In this use case, we will block any application that belongs to the anonymizer/proxy category.

Procedure

Step 1

Choose Policies > Security policies > Access Control and edit the access control policy.

Step 2

Click Add Rule and configure the rule for application control.

  1. Name the rule (for example, Block_Anonymizers).

  2. For Action, select Block.


    Application control rule name and action.

  3. If you have configured security zones and want to restrict traffic from inside to outside, click the Zones tab, and choose your inside zone as the source zone, and the outside zone as the destination zone.

  4. Click the Applications tab, select the applications to match, and click Add Application.

    As you select criteria, such as category and risk level, the list to the right of the criteria updates to show exactly which applications match the criteria. The rule you are writing applies to these applications.

    For purposes of this example, choose anonymizers/proxy from the Categories list and add it to Destinations and Applications. The match criteria should now look similar to the following graphic.


    Application control rule match criteria.
    Note

    For Port, leave the default, Application Default. This ensures that the system looks only at the default ports used for a selected application, rather than all ports.

  5. Click Logging next to the rule action, and enable logging at the start of the connection. You can select a syslog server if you use one.

    You must enable logging to get information about any connections blocked by this rule.

Step 3

Move the rule so that it comes after any rules that use protocol and port criteria only, but that would not allow traffic that should be blocked by the application rule.

Matching applications requires Snort inspection. Because Snort inspection is not needed by rules that use protocol and port only, you can improve system performance by grouping these simple rules at the top of the access control policy as much as possible.

Step 4

Deploy the changes.

You can use the application rule hit counts and analysis dashboards to see how this rule is performing and how often users try these applications.