For traffic to be bypassable, the traffic must match one of the filters or applications that you add to the Selected Applications and Filters list.

You can add a maximum of 50 items to the Selected Applications and Filters list. Each of the following counts as an item:

• One or more filters from the Application Filters list, individually or in custom combination. This item represents a set of applications, grouped by characteristic.

• A filter created by saving an application search in the Available Applications list. This item represents a set of applications, grouped by substring match.

• An individual application from the Available Applications list.

In the web interface, filters you add to the Selected Applications and Filters list are listed above and separately from individually added applications.

Note

For encrypted traffic, the system can identify and filter traffic using only the applications tagged SSL Protocol. Applications without this tag can only be detected in unencrypted or decrypted traffic. Also, the system assigns the decrypted traffic tag to applications that the system can detect in decrypted traffic only—not encrypted or unencrypted.

Use the Application Filters list to specify a set of applications, grouped by characteristic, whose traffic you want to match.

For your convenience, the system characterizes each application that it detects by criteria such as type, risk, and business relevance; you can use these criteria as filters or create custom combinations of filters.

Note that the mechanism for filtering bypassable applications is the same as that for creating reusable, custom application filters using the object manager.

Understanding How Filters Are Combined

When you select filters, singly or in combination, the Available Applications list updates to display only the applications that meet your criteria. You can select system-provided filters in combination, but not custom filters.

The system links multiple filters of the same filter type with an OR operation. For example, if you select the Low and Very Low filters under the Risks type, the resulting filter is:

Risk: Low OR Very Low

If the Low filter contains 110 applications and the Very Low filter contains 82 applications, the system displays all 192 applications in the Available Applications list.

The system links different types of filters with an AND operation. For example, if you select the Low and Very Low filters under the Risks type, and the Low and Very Low filters under the Business Relevance type, the resulting filter is:

Risk: Low OR Very Low
AND
Business Relevance: Low OR Very Low

In this case, the system displays only those applications that are included in both the Low or Very Low Risk type AND the Low or Very Low Business Relevance type.

Finding and Selecting Filters

To select filters, click the arrow next to a filter type to expand it, then select or clear the check box next to each filter whose applications you want to display or hide. You can also right-click a system-provided filter type (Risks, Business Relevance, Types, Categories, or Tags) and select Check All or Uncheck All.

To search for filters, click the Search by name prompt above the Available Filters list, then type a name. The list updates as you type to display matching filters.

After you are done selecting filters, use the Available Applications list to add those filters to the Selected Applications and Filters list.

For traffic to match a bypassable application or filter configuration, the traffic must match one of the filters or applications that you add to the Selected Applications and Filters list.

Browsing the List of Applications

When you first start to specify applications the list is unconstrained, and displays every application the system detects, 100 at a time:

• To page through the applications, click the arrows underneath the list.

• To display a pop-up window with summary information about the application’s characteristics, as well as Internet search links that you can follow, click the information icon () next to an application.

Finding Applications to Match

To help you find the applications you want to match, you can constrain the Available Applications list in the following ways:

• To search for applications, click the Search by name prompt above the list, then type a name. The list updates as you type to display matching applications.

• To constrain the applications by applying a filter, use the Application Filters list. The Available Applications list updates as you apply filters. For your convenience, the system uses an unlock icon () to mark applications that the system can identify only in decrypted traffic—not encrypted or unencrypted.

Once constrained, an All apps matching the filter option appears at the top of the Available Applications list.

Note

If you select one or more filters in the Application Filters list and also search the Available Applications list, your selections and the search-filtered Available Applications list are combined using an AND operation. That is, All apps matching the filter includes all filters you selected in the Application Filters list well as the individual applications displayed as the result of the search string entered above the Available Applications list.

Selecting Single Applications

After you find an application you want to match, click to select it. Right-click and select Select All to select all applications in the current constrained view.

You can match a maximum of 50 applications by selecting them individually, and filters you add are listed above and separately from individually added applications. To add more than 50 you must use filters to group applications.

When selecting applications, warning icons indicate invalid configurations. For details, hover your pointer over the icon.

Selecting All Applications Matching a Filter

Once constrained by either searching or using the filters in the Application Filters list, the All apps matching the filter option appears at the top of the Available Applications list.

This option allows you to add the entire set of applications in the constrained Available Applications list to the Selected Applications and Filters list, at once. In contrast to adding applications individually, adding this set of applications counts as only one item against the maximum of 50, regardless of the number of individual applications that comprise it.

When you specify applications this way, the name of the filter you add to the Selected Applications and Filters list is a concatenation of the filter types represented in the filter. For example, the following filter name includes two filters under the Risks type and three under Business Relevance:

Risks: Very Low, Low Business Relevance: Very Low, Low, Medium

Filter types that are not represented in a filter you add with All apps matching the filter are not included in the name of the filter you add. The instructional text that is displayed when you hover your pointer over the filter name in the Selected Applications and Filters list indicates that these filter types are set to any; that is, these filter types do not constrain the filter, so any value is allowed for these.

You can add multiple instances of All apps matching the filter, with each instance counting as a separate item in the Selected Applications and Filters list. For example, you could add all very low risk applications as one item, clear your selections, then add all very low business relevance applications as another item. This configuration matches applications that are very low risk OR have very low business relevance.

Speed of Application Identification

The system cannot bypass an application before:

• a monitored connection is established between a client and server, and

• the system identifies the application in the session

This identification should occur within 3 to 5 packets, or after the server certificate exchange in the SSL handshake if the traffic is encrypted. If one of these first packets appears before application identification is complete, the access control policy allows the packet to pass without identifying the application but subject to further inspection. This behavior allows the connection to be established so that applications can be identified.

The allowed packets are inspected by the access control policy’s default intrusion policy (not an access control default action intrusion policy). After the system completes application identification, it applies any access control rule actions. At this point the system determines if there is any allowed traffic. The system then implements IAB if the following conditions are met:

• you have deployed a network discovery policy with application detection enabled

• you have deployed an access control policy with IAB enabled in test or bypass mode

• a configured IAB inspection performance threshold is exceeded

• a bypassable application is detected

• a configured IAB flow bypass threshold is exceeded

Following IAB handling, the system applies any associated intrusion and file policy.

Handling Encrypted Traffic

Note

The IAB decision to trust (bypass) or allow (would have bypassed) traffic takes place near the end of flow inspection and immediately subsequent to the system decision whether there is any traffic to allow. However, IAB is an independent configuration within an access control policy. That is, IAB can affect traffic regardless of any access control rule, the default action of an access control rule, or the default action of the access control policy.

The system can identify and filter unencrypted application traffic that becomes encrypted using StartTLS, such as SMTPS, POPS, FTPS, TelnetS, and IMAPS. In addition, it can identify certain encrypted applications based on the Server Name Indication in the TLS client hello message, or the server certificate subject distinguished name value.

These applications are tagged SSL Protocol. Applications without this tag can only be detected in unencrypted or decrypted traffic.

Handling Application Traffic Packets Without Payloads

The system applies the default policy action to packets that do not have a payload in a connection where an application is identified.

Handling Referred Traffic

To identify bypassable traffic such as advertisement traffic referred by a web server, specify the referred application rather than the referring application.

Automatically Enabling Application Detectors

At least one detector must be enabled for each application you specify as bypassable. If no detector is enabled for an application, the system automatically enables all system-provided detectors for the application; if none exist, the system enables the most recently modified user-defined detector for the application.

Controlling Application Traffic That Uses Multiple Protocols (Skype)

The system can detect multiple types of Skype application traffic. When specifying Skype traffic as bypassable, select the Skype tag from the Application Filters list rather than selecting individual applications. This ensures that the system can handle all Skype traffic the same way.