Application Control on FortiGate: configuration in FortiOS 7.6

1. What is Application Control exactly?

Application Control on FortiGate analyzes traffic by application type and enforces policies such as Allow, Monitor, Block, Quarantine, or limit based on admin settings. For example, traffic on TCP/443 may be recognized as VPN, Proxy, Remote Access, File Sharing, GenAI, or DNS over HTTPS.

This capability matters when simply closing ports is not sufficient. Many applications operate over HTTPS or common ports. If you only control ports, tools like Remote Access or Proxy may still pass via allowed paths. Application Control focuses on the actual application rather than the port number.

Note Application Control alone does not replace all security profiles. It is typically used together with Web Filter, DNS Filter, IPS, Antivirus, and SSL Inspection.

2. How does Application Control differ from Web Filter and DNS Filter?

These three capabilities are sometimes confused, but each makes decisions in a different security layer.

If the goal is to block a specific site, Web Filter is more suitable. If you want to control resolution of malicious domains, DNS Filter is preferable. If you need to detect VPN/Proxy/Remote Access tools even on common ports, Application Control plays a central role.

3. How does Application Control detect applications?

FortiGate uses Application Signatures and IPS decoders. Traffic is examined by a policy; if it matches a program or category pattern, the corresponding Application Sensor rule is applied.

Rules can be written based on Category, Technology, Popularity, Risk, or specific applications. For example, you can block the entire Proxy category but allow an exception for a particular program, or Monitor Remote Access while blocking high-risk tools.

Warning Some encrypted applications may require SSL Deep Inspection for accurate identification. Without decryption, FortiGate may only see parts of information such as SNI or certificates.

4. In which scenarios is Application Control used?

• Control VPN and Proxy tools to prevent policy circumvention
• Control Remote Access tools such as AnyDesk, TeamViewer, RustDesk
• Control DNS over HTTPS or DNS over TLS alongside DNS Filter
• Limit file sharing, P2P and unauthorized cloud storage
• Monitor or restrict GenAI and general AI services
• Manage Guest networks to prevent misuse or high-risk traffic
• Reduce Shadow IT and provide logging for SOC / FortiAnalyzer

In large environments, Application Control is not only about blocking; it is often deployed in Monitor mode first to learn user app usage before final policy is written.

5. Key scenarios: VPN, Proxy, Remote Access and DoH

Controlling VPN and Proxy

If users can use VPN or Proxy, it may bypass Web Filter, DNS Filter, or some access policies. In this scenario, review categories related to Proxy, VPN, Anonymizer and Proxy Avoidance; Block as needed.

Operational tip Start by monitoring rather than blocking VPN/Proxy. Observe the tools used, then create exceptions for approved tools and Block the rest.

Controlling Remote Access

Tools like AnyDesk, TeamViewer, RustDesk and Chrome Remote Desktop pose significant risk if used without control. Consider blocking Remote Access for regular users and allow for IT teams via a separate rule with logging.

Controlling DoH and DoT

DoH and DoT can bypass classic DNS filtering. Application Control can help identify DoH, but deeper, HTTPS DoH detection generally benefits from SSL Inspection. DoH signatures are available and deep inspection may be required for custom DoH servers.

Controlling GenAI and new services

FortiOS 7.6 introduces Application Control scenarios to monitor or restrict access to certain GenAI services, helping organizations manage AI service usage.

6. Building an Application Control Profile in GUI

To build a profile in FortiOS 7.6, navigate to:

• Security Profiles → Application Control
• Create New: Name: APP-Users-Control
• Add Categories / Applications → Action: Monitor or Block
• Enable Logging for matched applications

Sample structure for a corporate user policy is as follows:

7. Building an Application Control Profile in CLI

In CLI, an Application Control Sensor is created with the command set config application list. The example below creates a basic Sensor and places a Category in Monitor mode. Category numbers should be checked from the live GUI or device output.

• config application list
• edit

برای ارزیابی پایداری، امنیت و نگهداری این زیرساخت، راهنمای پشتیبانی شبکه را نیز مطالعه کنید.