Using EnGenius' advanced Layer 7 traffic analysis technology, you can create firewall rules to block specific applications without specifying IP addresses or port ranges. This feature is particularly useful when applications frequently change their IP addresses or use multiple IPs.
Traditional firewalls often struggle with applications that frequently change IP addresses or use multiple IPs, making it hard to maintain effective firewall rules. EnGenius' Layer 7 firewall solves this by:
Blocking Specific Applications and Categories: Identify and block traffic based on application signatures
Adapting to Changes: Automatically adjust to changes in application behavior and infrastructure
Simplifying Management: Focus on applications and categories instead of constantly changing network parameters
Benefits
Enhanced Security: Block unwanted applications to protect your network
Simplified Rule Management: No need to update rules for changing IP addresses or port ranges
Policy Enforcement: Ensure compliance by restricting access to non-compliant applications
Advanced Source IP Filtering: Block applications based on source IP, allowing you to apply rules to specific departments or LAN segments. For example, you can block video and music for the staff LAN while allowing them for others.
Configuration Steps
Go to Configure > Gateway > Firewall > Outbound Rules > Layer 7 to add rule
Input the Source IP if you need to block a specific source IP address
Select an Applications to be blocked, using the second drop-down to be more specific if necessary.
When configuration is complete, please check Apply
Note:
Layer 3 rules (Refer to L3 Firewall for details) are processed before Layer 7 rules, with priority given to the first match found.
Firewall rules of any type apply solely to traffic that passes through the firewall device. This means that rules do not affect traffic originating from the firewall (such as LDAP binds) or terminating at the firewall (such as client VPN connections). Furthermore, ESG VLAN interfaces and the ESG WAN IP addresses are not taken into account in Allow or Deny rules.
Blocking specific applications not listed under Layer 7 firewall rules
To block specific applications not listed under Layer 7 firewall rules, ESG gateway can be used to prevent clients from accessing these applications. While the dashboard provides a list of popular applications in predefined categories, network administrators may occasionally need to block a particular application that isn't listed.
Take the example of League of Legends, which is not currently included in the "Online Gaming" category but can still be blocked by following these steps:
Identify the public IP addresses and URLs used by the application's servers.
League of Legends uses the following subnets and URLs:
IP Addresses
192.64.168.0/24
192.64.169.0/24
192.64.170.0/24
216.133.234.0/24
31.186.224.0/24
31.186.226.0/24
64.7.194.0/24
66.150.148.0/24
95.172.70.0/24
95.172.65.0/24
URLs
pvp.net
leagueoflegends.com
Create a Layer 3 rule to block outbound connections to these IP addresses and URLs
By implementing these steps, administrators can block access to unlisted applications efficiently.
Processing flow diagram between L3 firewall and L7 firewall
When the device is received traffic, it will check L3 firewall rule first, and then to check L7 firewall rule
Reference example L3 and L7 firewall rule
L3 Firewall rule configuration
L7 Firewall rule configuration
Allowed traffic by default
Outbound traffic is allowed through the firewall by default, unless it is explicitly blocked by an L3 or L7 rule. In this example, FTP traffic on TCP port 21 will pass through the firewall because no L3 or L7 rules are configured to block it
L3 Rules
Rule1: No match
Rule2: No match
Rule3: No match
L7 Rules
No match
Blocked traffic by L3 rule
In this example, FTP traffic on TCP port 21 will be blocked by the L3 firewall due to rule 3, which explicitly blocks it. Layer 7 rules will be ignored, as the traffic is already blocked by the L3 rules.
L3 Rules
Rule1: No match
Rule2: No match
Rule3: Match, traffic blocked
L7 Rules
Not processed
Blocked traffic by L7 rule
In this example, HTTP traffic on TCP port 80 is allowed by L3 firewall rule 1 and then passed to L7 rule checking. The L7 rule blocks Facebook application traffic, so this traffic will be blocked.
L3 Rules
Rule1: Match, HTTP (TCP port 80) traffic allowed
Rule2: Not processed
Rule3: Not processed
L7 Rules
Match, Facebook application traffic blocked
List of Layer 7 Categories
Each category also has an "all" rule (e.g. All Advertising) that will apply every individual rule under it when configured.
Important Notice: If an application does not fall under the categories, rules, or classification names listed in the table below, it will not be supported.
Categories | Rule/Classification Name |
Advertising |
|
Business management |
|
| |
Online Gaming |
|
Health care | Cerner Corporation |
Vocie Calls |
|
News |
|
Online sharing and backup |
|
Productivity |
|
Portals and Search Engines |
|
Reference and Research |
|
Remote monitoring & management |
|
Security |
|
Social web & photo sharing |
|
Social Networking |
|
Software & anti-virus updates |
|
Shopping and Auction |
|
Sports |
|
Travel & Transportation |
|
Streaming |
|
Video Conference |
|
Finance and Insurance |
|
Important Notice: If an application does not fall under the categories, rules, or classification names listed in the table above, it will not be supported.