AppCtrl protocol enforcement check

Protocol enforcement allows you to configure networking services (e.g. FTP, HTTP, HTTPS) on known ports (e.g. 21, 80, 443). For protocols which are not whitelisted under select ports, the IPS engine performs the violation action to block, allow, or monitor that traffic.

This feature acts upon the following two scenarios:

• When one protocol dissector confirms the service of network traffic, protocol enforcement can check whether the confirmed service is whitelisted under the server port. If it is not, then the traffic is considered a violation and IPS can take the action specified by config (e.g. block).
• When there is no confirmed service for the network traffic, the traffic is considered a service violation if IPS dissectors rule out all of the services enforced under its server port.

CLI configuration

In an applicable profile, a default-network-service list can be created to associate well known ports with accepted services.

To setup protocol enforcement in the CLI:

A new table is displayed when the Network Protocol Enforcement toggle is set to the On position. Enforced entries can be created, edited, or deleted to configure network services on certain ports and determine the violation action.

To setup protocol enforcement in the GUI:

1. Go to Security Profiles > Application Control.
2. Enable Network Protocol Enforcement.
3. Click Create New.
4. In the New Default Network Service window:
   1. Enter a Port
   2. Select the Enforced protocols.
   3. Choose the Violation action.
   4. Select OK.