Configure Layer 7 Objects

Create a Custom Application Signature

You can create custom application signatures on a per-tenant basis. This means that multiple tenants can define an application object that have the same application name, but that have different signatures, and vice versa.

You can use custom application objects multiple times in the configuration, such as when you define application group objects and NGFW policy rules.

When you configure an application filter object based on application attribute match information, the application filter matches both predefined and custom applications, based on the application attributes. For more information, see Configure Security Access Policy Rules.

To create a custom application signature:

1. In Director view:
   1. Select the Configuration tab in the top menu bar.
   2. Select Devices > Devices in the horizontal menu bar.
   3. Select a device in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Objects & Connectors  > Objects > Custom Objects  > Applications in the left menu bar.
4. Click the  Add icon. In the Add Application window, enter information for the following fields.
   
   
    

   Field	Description
   Name	Enter a name for the application.
   Description	Enter a text description for the application.
   Precedence	Enter a unique priority number to use when multiple applications match the traffic. The application with a higher precedence value is matched first.
   Application Timeout	Enter how long to wait, in seconds, for the application to timeout because of inactivity.
   Application Match IPS	Click to enable the matching of applications using an IPS signature.

5. Select the Attributes tab, and enter information for the following fields.
    

   Field	Description
   Family	Select the application's family type.
   Subfamily	Select the application's subfamily.
   Risk	Click to assign a risk level to the application. For more information, see Risk Levels in Application Signatures, above.
   Productivity	Click to assign a productivity value to the application. Red (1) indicates the lowest productivity value, and green (5) indicates the highest productivity value.
   Application Tags	Click to assign a tag to the application for classification purposes: General SD-WAN Security

6. Select the Match Information tab, and then click to choose the match criteria information for the application. In the Add Match Information window, enter information for the following fields.
    

   Field	Description
   Name	Enter a name for the match rule name for the custom application.
   Host Pattern	Enter the host pattern to detect.
   Protocol Value	Enter the applications protocol value to detect.
   Source Address	Enter the source IP address of the application on which the rule is applicable.
   Destination Address	Enter the destination IP address of the application on which the application rule is applicable.
   Source Port	Click to enable, and assign a custom source port for the application: Range—Select to enable the Low and High fields, and then enter the lowest and highest source port numbers on which the security policy is applicable. Value—Select to enable the Source Port Value field, and then enter the application port on which the security policy is applicable.
   Destination Port	Click to enable, and assign a custom destination port for the application: Range—Select to enable the Low and High fields, and then enter the lowest and highest destination port numbers on which the security policy is applicable. Value—Select to enable the Source Port Value field, and then enter the application port on which the security policy is applicable.

7. Click OK.

Create an IPS Signature To Identify a Custom Application

To identify a custom application, the IPS signature must include the following

• <classtype:aap-id;>.
• <pktnum:[<|>]number;>—pktnum has a format similar to the dsize keyword. Use pktnum to restrict IPS to detect the application in the first few packets of the session.
• <appid:app_name;> keyword,—app_name must matche the name of the custom application. For example, if the custom application name is enterprise-internal-1, configure appid as appid:enterprise-internal-1
• <versa_parent_appid;> keyword—The value for this keyword is the application reported by the Qosmos engine or VOS device. This keyword helps to identify the application in appid. For example, if the custom application name is enterprise-internal-1 and the application reported by Versa appliance without your custom signature is http, in the custom signature, configure versa_parent_appid as versa_parent_appid:http and the appid as appid:enterprise-internal-1.

View Predefined URL Categories

VOS devices approximately 83 predefined URL categories, which are updated regularly through the Versa SPack updates. For more information, see Use Security Packages. If the predefined URL categories do not meet your requirements, you can define custom ones based on URL strings or pattern matches.

To view the predefined URL categories:

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Objects & Connectors  > Objects > Predefined Objects > URL Categories  in the left menu bar.
   
   

For information about configuring predefined and custom URL categories, see Configure Security Access Policy Rules.

Configure Custom URL Categories

You can create custom URL category objects on a per-tenant basis. Each custom URL category has a unique name and defines information about the URLs to match using a string match or a pattern match. You also associate a reputation value with the URL category. You can use a custom URL category in NGFW and SD-WAN policy rules to specify match criteria for a Layer 7 URL category. You can also specify custom URL categories in the category-based action rules and reputation-based action rules of a URL-filtering profile.

For information about configuring predefined and custom URL categories, see Configure Security Access Policy Rules.

To define a custom URL category and use it with a URL filtering profile or as a match criteria in a policy rule:

1. In Director view:
   1. Select the Administration tab in the top menu bar.
   2. Select Appliances in the left menu bar.
   3. Select a device in the main pane. The view changes to Appliance view.
2. Select the Configuration tab in the top menu bar.
3. Select Objects & Connectors  > Objects > Custom Objects  > URL Categories  in the left menu bar.
4. Click the Add icon to add a new category. In the Add URL Category popup window, enter information for the following fields.
    

   Field	Description
   Name	Enter a name for the URL category name. This name is displayed in the category list when defining the URL-filtering policies and in the match criteria for URL categories in policy rules.
   Description	Enter a text description of the URL category.
   Tags	Enter a keyword or phrase that allows you to filter the URL category. This is useful when you have many URL categories and want to view those that are tagged with a particular keyword.
   Confidence	Enter a confidence value for the category. This value is used to break the tie when multiple URL categories match a single URL. A higher confidence value takes precedence. Range: 1 through 100
   URL File	Select a URL file to upload a CSV file that contains multiple strings and patterns. Each line in the file contains either a string or a regex pattern for the URL and the reputation associated with the URL. Entries in the CSV file have one of the following formats: string,URL,reputation pattern,URL,reputation For example: Using a string— string,www.versa-networks.com/,high_risk Using a regex pattern— pattern,.*versa-networks*,high_risk. If you include a backslash (\) or an open curly brace ({) in the regex pattern, you must escape it by preceding it with a backslash.

5. Select the URL Patterns tab, and enter information for the following fields.
    

   Field	Description
   Pattern	Enter a URL pattern to match and group the URLs. You can include regex patterns. For example, use the www.versa-networks.com pattern or use a wildcard like *.versa-networks. If you include a backslash (\) or an open curly brace ({) in the regex pattern, you must escape it by preceding it with a backslash.
   Reputation	Select a predefined reputation from the list and assign it to the URL match pattern.
   Add icon	Click the Add icon to add additional patterns.

6. Select the URL Strings tab, and enter information for the following fields.
    

   Field	Description
   String	Enter a URL string that you want to group.
   Reputation	Select a predefined reputation from the list and assign it to the URL string.
   Add icon	Click the Add icon to add additional patterns.

7. Click OK.