USG FLEX 200: Application Patrol / Content Filtering Policy
![thwartedEfforts](https://us.v-cdn.net/6029482/uploads/defaultavatar/nN4PAQRO7TCNP.jpg)
thwartedEfforts
Posts: 10
Freshman Member
![](https://www.zyxel.com/library/assets/zyxel-forum/freshman_member.png)
![Second Anniversary](https://us.v-cdn.net/6029482/uploads/badges/P6A4SUUFXBDU.png)
![First Comment](https://us.v-cdn.net/6029482/uploads/badges/MBNFIRD87YVH.png)
in Security
I have a FLEX 200 running V5.30(ABUI.0)
Creating the following Twitter app in Firewall🡒Configure🡒Security service
![Image: https://us.v-cdn.net/6029482/uploads/editor/oy/1onobr85feji.png](https://us.v-cdn.net/6029482/uploads/editor/oy/1onobr85feji.png)
And the following outbound lan policy in Firewall🡒Configure🡒Security policy
![Image: https://us.v-cdn.net/6029482/uploads/editor/2p/rauyx35iy1nk.png](https://us.v-cdn.net/6029482/uploads/editor/2p/rauyx35iy1nk.png)
My expectation would be that only traffic matching the Twitter app profile definition above would trigger it.
But this is not the case, with any/all traffic triggering the policy
![Image: https://us.v-cdn.net/6029482/uploads/editor/hv/pxdxsqmyt0ai.png](https://us.v-cdn.net/6029482/uploads/editor/hv/pxdxsqmyt0ai.png)
What am I doing wrong? What have I missed? Thanks in advance!
P.S. Second time of creating this message; had a modal JSON error dialog appear after editing a much longer post, then the discovery the post had been deleted
Creating the following Twitter app in Firewall🡒Configure🡒Security service
![Image: https://us.v-cdn.net/6029482/uploads/editor/oy/1onobr85feji.png](https://us.v-cdn.net/6029482/uploads/editor/oy/1onobr85feji.png)
And the following outbound lan policy in Firewall🡒Configure🡒Security policy
![Image: https://us.v-cdn.net/6029482/uploads/editor/2p/rauyx35iy1nk.png](https://us.v-cdn.net/6029482/uploads/editor/2p/rauyx35iy1nk.png)
My expectation would be that only traffic matching the Twitter app profile definition above would trigger it.
But this is not the case, with any/all traffic triggering the policy
![Image: https://us.v-cdn.net/6029482/uploads/editor/hv/pxdxsqmyt0ai.png](https://us.v-cdn.net/6029482/uploads/editor/hv/pxdxsqmyt0ai.png)
What am I doing wrong? What have I missed? Thanks in advance!
P.S. Second time of creating this message; had a modal JSON error dialog appear after editing a much longer post, then the discovery the post had been deleted
![:| :|](https://community.zyxel.com/plugins/emojiextender/emoji/twitter/neutral.png)
0
All Replies
-
Hi @thwartedEfforts,The steps a packet goes through a USG FLEX is illustrated in the diagram. If the traffic matches a UTM feature, then the gateway follows the action configured in the first matched UTM feature to block the traffic. In your example, the traffic needs to pass security policy rule first. Then the passed traffic will be scanned by App Patrol.
Best regards,
EmilyDon't miss this great chance to upgrade your Nebula org. For free!
0 -
Thanks for your help.
I've removed the Firewall entry and my single App Patrol test definition remains as below:
The Firewall🡒Configure🡒Security service page has Content filtering enabled and the App Patrol rule for Twitter visible:
However, nothing is logged from the above settings, and Twitter is not being blocked despite the App Patrol profile action rejecting it; this behaviour is the reason I'd originally created the Firewall rule.
I'm a little lost now!0 -
Hi @thwartedEfforts,You still need to apply App Patrol and Content Filter policy to security policy to make these UTM features work.
The traffic that match the action(allow), protocol, source, destination, dst. port, user and schedule in the security policy will be allowed and passed through the device. That's why all traffic that pass the security policy are logged in the event logs.- If the traffic is blocked by security policy rule, then it is blocked at the firewall and will not enter UTM engine for further check.- If the traffic is allowed by security policy rule, then the traffic enters the device and then enters UTM engine for App Patrol/Content Filter check if you apply App Patrol/Content Filter policies to this security policy rule.Best regards,
EmilyDon't miss this great chance to upgrade your Nebula org. For free!
0
Categories
- All Categories
- 414 Beta Program
- 2.2K Nebula
- 130 Nebula Ideas
- 88 Nebula Status and Incidents
- 5.4K Security
- 166 USG FLEX H Series
- 255 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 999 Wireless
- 36 Wireless Ideas
- 6.2K Consumer Product
- 233 Service & License
- 370 News and Release
- 77 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight