Still, with security profiles and same, we would see application control.
So let's go to application control and now let's know what application control is.
So application control detect applications based on their positions.
Its application has a unique position that it won't you fly it after the detection.
We can apply different action to the application, like a low monitor block or quanjian can also help
us through the direct application that consume a lot of bandwidth in our network so we can apply them
traffic shaping to limit and control their uses of Ben to it.
So like all security profiles, you can see that there is some default profiles.
But again, we are not going to use them, so I will create my own profile.
Here I would give it a name.
OK.
I could leave a comment if I want and heard first hand I can see is categories.
So each category of say that similar applications.
So like here in games, we have all the signatures of games like we see if we hover it here, we can
see that there is signatures here.
Those signatures, here are the buttons that application control, use what you don't.
You fly each application.
OK.
If we sit here, we can see the application is in the category.
For example, this is the number of applications in the category and here beside the cloud here.
This number here mean how many applications is a cloud based from in this category.
So we have six cloud based application in this category.
So perfect.
Now if we go and press this icon here.
Here we can see the actions that we can apply to each category so we can even monitor or low block or
quarantine.
Now let's see what is the differential between each auction.
So for a monitor, it's allowing the application to pass and it's a live a log of the application.
And for a low, it's only allowed the application, but there is no log for block.
It's of course, broken and therefore quarantine.
It's quarantine the IP of the user that you're trying to access this application for a certain time.
If you want to modify the time you can press the quarantine application like that, we will press it.
And here we can see that we can set a duration from days, hours and minutes.
OK, perfect.
That's just sitting.
There can be.
It can be modified for each category.
So each category can have a different duration.
OK, and here we can apply induction to all categories like we see here.
If we click here, quarantine this duration, air will be applied to all the categories.
OK, so let's scroll down, and here we can find network protocol enforcement if we enable it.
You can see that we can create a protocol code enforcement.
So what protocol enforcement means is that you can allow us to configure network services like a ship
B if ATP is ships and so on to a block application that use no the fourth port.
So for example, if we go ahead and enforce protocols and which shows if ATP normally, if ATP work
on Port 21, but if we have an application that use on another port rather than a Port 21 and use if,
for example, 21 21.
So we want to block this application here because we want only to allow default ports.
So we will do block here and we chose Block and we will do OK.
So I hope that it makes sense for you again, we can hear search protocols that we want to block them
on ports rather than their default port.
Another example is with a ship, normally your ship yours, port 18 and for example, we have an application
in our network that you was Port 1818.
And we don't want it to be allowed.
So.
We will block it like that.
If you don't know what's the purpose exactly that is up yours.
You can use the way I talk to it.
You don't.
You fly it.
OK, perfect.
So one thing that I want to mention here is that like you on watches here, we don't have the option
to enable and sit if the profile will be on flow based or proxy buys like we see in antivirus and we
filter and so on.
There is no there is no settings here to enable, like I said, floor based and proxy based.
Why?
Because application control use eyepiece engine Georgia two buttons and the eyepiece engine use only
flow based.
So that's why the application control don't have an option to enable a flow based or proxy based because
it's no use by default, flow based because it's based on an AI based engine.
So I hope that it makes sense.
I just want to clarify that.
So let's go on.
Here we have application and filter override.
So what's that to mean?
Let's go back again here, for example, here in remote access, if I block the category remote access
here, but I want only injunction will be allowed.
I want or the remote application to be blocked, but I want only, you know, this octopus.
So I will block it and they will go here to application and further overrides.
I would create a new profile.
I would change the action from block to allow or monitor if I want to log.
I will do just a no, and I will try to sit in a desk.
Perfect, here it is.
I would have predicted.
And they will dorky.
Not perfect.
No, all the remote applications like we see it in the category are blocked, but only energy is allowed.
Perfect.
And here we have some additional options, like hair block applications detect on know default ports
like we like we see here.
We can do it with network protocol enforcement.
And if we enable it here, if we're enabled block application on no the fourth port on, for example,
there is if play here that you bought when you want to renew one and he can only allow if Typekit that
you was bought when you won.
But do we have another application that you will see a ship with a different port and we want it to
be passed?
Then we can go here and create new.
And, for example, we can see that the application was brought to any.
One one.
OK.
211.
This is a random protocol port.
So I would choose the RFP and they will choose the ovulation action to monitor.
And the way that it will be allowed and a log will be suited for it.
OK.
So this option here will block all the FTB applications that use a port rather than the default port.
But here we already make our exemption for this port here.
Perfect.
Here we can allow unclogged in is traffic.
Yes, we can enable it.
And here we have an important protocol, which is quick.
So quick is a Google protocol.
It's by default blocked because it used UDP, which is not scanned by filtering.
So that's why it is blocked.
And here we have replacement messages for ECP based applications.
So what that means is that allowing us to replace blocked content with an explanation for the end user.
So when our end user access tool, an application that it's blocked, an exploration page would appear
to it that explained to him that this page is blocked because it's under category that it's blocked
in our FortiGate firewall, so our user can know that this application is blocked by the network administrator.
So if you want it to be allowed or you that administrator of a wrong choice, you can refer to him and
ask him to allow this particular application.
So that it for the configuration on the profile.
I will do it OK.
And now our profile is created again.
The profile is created, but it's not applied yet, so to apply as we need to go to the policy framework
policy.
And there in our policy.
It.
OK.
I would make it flow based.
It walks in on flowerbeds and proxy is butter.
Or with the.
But it's inflow based, and they will go head to application control.
And here I can find my application, which is some up.
And I recommend that your tool kit, but it did inspection tool, inspect encrypted traffic.
OK.
And they were dorky.
And it's perfect now our profile is assigned to the policy now on an important thing that I said before
in the beginning of the video is that application control or a story you don't you fly application that
you is on lot of bandwidth.
So to check what application, use a lot of bandwidth, we can go to a dashboard here and we can search
for application control.
Let me find it.
Here it is for of your application.
And you're in informed of your application.
We can find the application and what category it belong to it and we can find here.
How many sessions this application use and how many votes in this application console.
So from here we go to identify what application use our bandwidth and we can apply to it.
Traffic shaping provide.
So in my previous videos, I have created a Salafist shape in and they explain it.
But let's see again how to control bandwidth with application.
So I would go to a network.
And they will go, I think, to Paul and object here, and they will go to traffic shaper.
I will create a new traffic shaper.
I will keep it shared and it will name it.
For example.
Five.
You go white.
And they would keep the traffic high.
Next, been to it.
I would.
Five megabyte.
Yeah.
And to go into it also put five, I would keep it shared, and they will dorky.
Thank you, sir.
It's five megabyte.
Now I would go to the traffic shaping policy.
It will create new.
For example, I want this traffic shaping her to be up to apply to all.
For example, a YouTube.
They rename it.
Your job?
Because I don't want to my employee, if I, you know, on environment of work, I don't want my employee
to boss, there are a lot of your time in your job and they don't want you to have your consent on my
bandwidth because it's not necessary.
So where in source it would choose?
All.
If I have your address object, I can define it and choose it from here.
For example, although object of my online users here in this nation.
We chose all.
And here in services.
Also, all.
You schedule it would choose always.
And here in application.
I would try to find you a job.
Here it is.
I can apply it or also to all your categories.
If I am using we, we're today, I can also choose it from here.
But here I want to focus on applications, so I take an example of your job.
So I want to control the bandwidth that you, your viewers.
Here in action, I would choose Uplay cheaper, and you are an object oriented face, I would choose
my one and your face.
And here in shared chamber.
It would choose to provide the take rate.
OK.
I didn't create a profile for per IP shaper, so I will not enable it, and they will dorky.
And that's it.
This is out of control.
Ben, do it, that's our obligation use.
So this is all for application control.
I hope that you would like the video, please, if you have any question.
Don't hesitate to ask me.