Why are the first few packets of a blocked application let through?

The FortiGate needs to see some of the session (the handshake and first data) before a signature can match. Once identified, the session is blocked and later sessions of that application are recognised quickly.

Is application control the same as web filtering?

No. Web filtering decides by website category. Application control decides by application, including ones that aren't websites at all, such as file-sharing clients, remote access tools and VPN or proxy apps.

FortiGate Application Control: Signatures, Categories and Overrides | FortiGate Course

Application control

Identifying applications by signature rather than port, category and override actions, non-default ports, and when deep inspection is needed.

Intermediate · 9 min read

What you will learn

After this lesson, you can build an application control profile with category actions and overrides, block applications that hide on non-default ports, and know when deep inspection is needed.

App signatures
Categories and overrides
Non-default ports

Application control identifies the application in a session from FortiGuard application signatures, by its behaviour and protocol patterns rather than its port. An application control profile then allows, monitors, blocks or rate-limits applications by category (such as P2P or Proxy) or individually, with overrides for exceptions.

In simple terms: Port 443 might be a web page, a file-sharing app or a tunnel that bypasses the firewall. Application control recognises which it really is.

A real-life situation

FGT1 only allows HTTP, HTTPS and DNS out. Yet the logs show a user running a peer-to-peer client and another tunnelling all their traffic through a free proxy app, both over TCP 443. Port-based policies can't tell them apart from web browsing. Application control can.

Build the profile

Simplified illustration of the FortiOS 7.4 GUI · not a screenshot

FGT1Security Profiles › Application Control

Edit Application Sensor: Staff-AppCtrl

P2P: Block
Proxy: BlockProxy and anonymiser apps bypass every other control.
Remote.Access: Monitor
Video/Audio: Monitor
All other categories: Monitor
Override 1: TeamViewer → Allow The help desk's approved remote access tool.
Block applications detected on non-default ports: On
Allow and log DNS traffic: On

Categories set the broad policy. Monitor everything you don't block, so logs show what is in use.
Overrides make exceptions: allow one remote access tool while the category stays monitored, or block one application in an allowed category.
Non-default ports: an application normally on port 80 or 443 that appears elsewhere is suspicious; blocking it closes a common evasion trick.

On the CLI the profile is config application list, and the policy references it with set application-list "Staff-AppCtrl".

Encrypted applications

Many applications can be recognised from unencrypted parts of the session, such as the TLS server name or the traffic pattern. Others, and especially actions inside cloud applications (uploading to a personal cloud drive, posting rather than reading), can only be identified with deep inspection. Application signatures marked as requiring SSL inspection show this in the GUI.

Reading the results

Log & Report › Security Events › Application Control lists each detection with the application, category, action and policy ID. Dashboard › FortiView Applications shows the busiest applications and their users, the quickest way to see what "monitor" has found before deciding what to block.

Why it works this way

Applications choose their own ports, and many deliberately use 443 to get through firewalls. Recognising them by signature moves the decision from "which port" to "which application", which is what the business actually cares about.

Common mistakes

Blocking whole categories without monitoring first, and breaking business tools.
Expecting control of actions inside cloud apps without deep inspection.
Forgetting overrides are evaluated before categories: a broad allow override can undo a category block.

Key takeaways

✅ Key takeaways

Application control identifies applications by signature, regardless of port.
Category actions set the default; application and filter overrides make exceptions.
Block applications on non-default ports to stop evasion.
Some applications and in-app actions need deep inspection to be identified.

Check yourself

Predict · scenario 1

A policy allows only HTTPS, yet a P2P client works through it on port 443. What stops it?

Predict · scenario 2

The Remote.Access category is monitored, but only TeamViewer should be allowed and the rest blocked. What do you configure?

FAQ

Why are the first few packets of a blocked application let through?: The FortiGate needs to see some of the session (the handshake and first data) before a signature can match. Once identified, the session is blocked and later sessions of that application are recognised quickly.
Is application control the same as web filtering?: No. Web filtering decides by website category. Application control decides by application, including ones that aren't websites at all, such as file-sharing clients, remote access tools and VPN or proxy apps.