How to use APP Enforcement?

APP Enforcement (APPE) helps the Network Administrator block applications (IM/P2P/Protocol/Others) on the LAN network. The following example shows how to prevent LAN clients from using YouTube service by APPE.

1. Go CSM >> APP Enforcement. Click an index to create a new profile.

2. Set up the details in the profile.

  • Enter a profile name.
  • Choose YouTube in For Firewall tab.
  • Click OK to save.

3. Go to Firewall >> Filter Setup to create a filter rule and apply the APP Enforcement profile created in Steps 1 & 2.

  • Enable the Filter Rule.
  • Select the Direction to LAN/DMZ/RT/VPN -> WAN
  • (optional) Edit the Source IP if you want to apply this firewall rule to certain IP only.
  • Select Pass Immediately for Filter Action.
  • Select the APP Enforcement profile created in Steps 1 & 2.
  • Enable Syslog for monitoring and troubleshooting.
  • Click OK to save.

With the above configuration, LAN clients will not be able to use YouTube.

We will see the following message in the syslog when APP Enforcement is working.

1. Go Security / Firewall Filters / Content Filters. Add a content filter rule and configure it as follows.

  • Enter the profile name.
  • Check Enabled.
  • (Optional)Edit the source IP and interface if you want to apply this firewall rule to a certain IP range only. Here we leave it as Any so that the router can prevent all LAN clients from using YouTube service.
  • Drag down the menu and select [APPE]YouTube. You can type the keyword on the search bar to find the related category.
  • Choose Block for Action.
  • Enable Syslog for monitoring and troubleshooting.

With the above configuration, LAN clients will not be able to use YouTube.

We will see the following message in the syslog when APP Enforcement is working.

1. Go to System Maintenance >> APP Signature Upgrade >> Auto APP Signature Upgrade to make sure the router has the latest version of APP Signature.

a screenshot of Vigor3900 Auto APP Signature Upgrade

2. Go to Firewall >> Filter Setup, and click Add in the Application Filter tab

  1. Give a Profile Name
  2. Enable the profile
  3. (optional) Set up Time Object for office hour and Source IP of specific LAN clients
a screenshot of Vigor3900 Firewall Application Filter profile

3. Click Add in APP Block

  1. Select the forbidden application(s).
  2. Click Apply
a screenshot of Vigor3900 Application filter profile

Now we can try to open TOR browser to see if it's blocked.

a screenshot of TOR Browser

Enable Syslog to print the Firewall Log. We will see the following message on the Syslog File tab when the APP filter is triggered.

a screenshot of Vigor3900 syslog

Published On: 2020-03-20 

Was this helpful?   

book icon

Related Articles