Application Filtering Intelligence

Application Filtering Intelligence allows filtering of traffic based on the application (such as YouTube, Netflix, Sophos, or Facebook) or application family (such as antivirus, web, erp, or instant-messaging) or application tags. Enables traffic filtering by layer 7 applications, which means you can filter out high-volume, low-risk traffic from reaching the tools and distribute high-risk network traffic of interest to the right tool at the right time.

Refer to the following topics for more detailed information and step-by-step instructions on how to configure Application Filtering Intelligence application and view the statistics:

Configure Application Filtering Intelligence for Virtual Environment

Application Filtering Intelligence (AFI) can be configured in the Monitoring Session Canvas. To add Application Filtering application to the canvas, follow the steps given below:

  1. Drag and drop New Map from New to the graphical workspace.
  2. Click the application and select Details. The Application quick view appears.
  3. Enable Application Filtering in the GENERAL tab.
  4. In the Application quick view, enter or select the following details in the GENERAL tab:

    Parameter

    Description

    Name

    Enter a name for the application.

    Description

    Enter the description.

    Application Filtering Settings

    Bidirectional

    Enable or Disable Bi-Directional Flow behavior. Bi-Directional is enabled by default. Disable this option for Uni-Directional Flow behavior.

    Timeout

    Specify the traffic flow inactivity timeout, in seconds. The session will be removed due to inactivity when no packets match.

    Buffer

    This option is enabled by default.

    Buffer Count Before

    Number of packets that should be buffered until the flow is identified. If the flow is not identified even after reaching the maximum number of packets buffered, then all the subsequent packets of this session will be dropped.

    Protocol

    Select the Protocol. The packet matching the selected protocol will be filtered. The default value is TCP-UDP.

    Session Slicing

    Enable or Disable session slicing to enter the Packet Count. Packet Count is disabled by default. The Packet Count limits the number of packets passed per flow to a configurable value in the range 2–100. Useful when tools only need the first few packets, such as TLS handshakes.

    Session Fields

    Session Field

    The Packet fields to be considered for creating the Session / traffic flow (Session key fields)

    Action

    Add or Remove 'VlanId' Packet field for creating the session / traffic flow.

    Advanced Settings

    Number of Flows

    The number of flows supported by the application.
    Refer to the following table for the maximum number of flows supported for VMware, AWS, and Azure platforms.

      Cloud Platform

    Instance Size

    Maximum Number of Flows

    VMware

    Large (8 vCPU and 16GB RAM)

    200k

    AWS

    AMD - Large (c5n.2xlarge)

    300k

    AMD - Medium (t3a.xlarge)

    100k

    ARM - Large (c7gn.2xlarge)

    100k

    ARM - Medium (m7g.xlarge)200k

    Azure

    Large (Standard_D8s_V4)

    500k

    Medium (Standard_D4s_v4)

    100k

    Nutanix

    Large (8 vCPU and 16GB RAM)

    200k

    ■  Medium Form Factor is supported for VMware ESXi only when secure tunnels option is disabled. The maximum Number of Flows for VMware ESXi when using a medium Form Factor is 50k..
    ■  If the rate of unique UDP sessions per second exceeds the threshold—calculated as maximum number of flows per second divided by the UDP timeout value—the system may fail to classify applications correctly. In such cases, AFI may not filter packets accurately, resulting in incorrect packet passes or drops. However, this limitation does not apply to DNS flows.

    Fast Mode

    Enable the Fast Mode option for performance (less CPU cycles and less memory utilization) improvement. When the Fast Mode is enabled, some or all of the attributes of the applications will be disabled. You can view the list of attributes/applications available in the fast mode by navigating to the app editor under AMI feature in the GigaVUE‑FM. If all the attributes of the application are disabled then the application itself is disabled. Refer to Application Intelligence Sessionsection for more information on the benefits and Limitations of the Fast Mode.

  5. Click the RULESETS tab. Through the map, packets can be dropped or passed based on the highest to lowest rule priority. You can add 5 rule sets on a map. Each rule set can have only 25 rules per map and each rule can have a maximum of 4 conditions.

    Enter the following details for each of the Rule Set created:

    Parameter

    Description

    Priority

    A priority determines the order in which the rules are executed. The priority value can range from 1 to 5, with 1 being the highest and 5 is the lowest priority.

    AE ID

    Application Endpoint ID will be used as source or destination object for creating or connecting links

    Actions

    Using this option, you can perform the following functions:

    ● New Ruleset- Use to add a new Rule Set.

    Note: A maximum of 5 Rule Sets can be created.

    ● New Rule- Use to add a New Rule

    Note: A maximum of 25 Rules can be created per rule set.

    ● Delete this Ruleset- Use to delete the Ruleset

    RULES

    Rule

    Use the toggle button to Pass or Drop the traffic through the map.

    Condition

    Select any one of the conditions from the drop-down menu and search or select the attributes.

    Use the + and - buttons to add or remove a condition with a Rule.

    Click and select Add Condition to add more conditions.

    Note: A maximum of 4 conditions can be created per Rule.

    APPLICATION FILTERING

    Select the applications and their attributes for traffic filtering by layer seven applications. You can select a maximum of 64 attributes for each application.

    Add Application

    Click on the Add Application button. The Add Application dialog box opens.

    Select a Type. The available options are:

    • Application Family: Each application is mapped only mapped to one Application Family

    ■  Select an Application Family and the Applications that needs to be filtered from the traffic.
    ■  In the Traffic Action column, select Pass or Drop to pass or drop the traffic. You can also use Pass All or Drop All to allow or drop the traffic for all the applications.

    • Application Tag: Each application can be mapped to one or more Application Tags.

    ■  Select an Application Tag and the Applications that needs to be filtered from the traffic.
    ■  In the Traffic Action column, select Pass or Drop to pass or drop the traffic. You can also use Pass All or Drop All to allow or drop the traffic for all the applications.

    User Defined Applications: To configure User Defined Applications for AFI, follow the steps given below.

    a. Enable User Defined Applications toggle button in the Options page. Refer to User Defined Application topic for more detailed information on what is user defined applications and how to configure it.
    b. In this Add Application dialog box, select User Defined Applications from the Application Family list.
  6. To pass or drop any remaining traffic in the network, enter the priority and AE ID in the default rule set available. Select Pass or Drop option for Any Remaining Traffic field.
  7. Click the THRESHOLDS tab. For more details on how to create and apply threshold template, refer to Traffic Health Monitoring.
  8. To reuse the configuration, click Add to Library. Save the application filtering configurations using one of the following ways:
    1. Select an existing group from the Select Group list or create a New Group with a name.
    2. Enter a description in the Description field, and click Save.
    3. The saved map can be found in the Map Library in the Edit Monitoring Session Canvas Page.
  9. Click Save.

To edit a map, select the map and click Details, or click Delete to delete the map.

When using the Application Filtering application, you can either use a single tunnel, to tunnel all the filtered traffic from the application or use a separate tunnel for each rule configured.

View Application Statistics for Application Filtering

To view the application Statistics for the Application filtering application, follow the steps given below:

  1. Click Traffic > Virtual > Orchestrated Flows > Select your cloud platform.
  2. Select a monitoring session from the list view, click Actions > Edit. The Edit Monitoring Session page appears.
  3. Click the application and select Details. The Application quick view appears.
  4. Click on STATISTICS tab.
  5. You can view the following in the Application Filtering application statistics page:
    1. Rules - Displays the rules created in this application.
    2. Pass App (Bytes) - Displays the packet that pass through the applications selected.
    3. Drop App (Bytes) - Displays the packets that are dropped by the applications selected.
    4. Pass Rule (Bytes) - Displays the packet that pass through the rule sets configured.
    5. Drop Rule (Bytes) - Displays the packets that are dropped by the rule sets configured.