Application Identification and Bandwidth Management
This domain tests how the firewall recognizes applications beyond ports and how it enforces rate limits. Scenario questions often ask why a port-based rule fails to control P2P or video.
Core rules
- Application identification uses signature and behavior analysis; it can identify applications that use dynamic ports or HTTP tunneling.
- Security policies can match application and application group, which is more precise than a service/port rule.
- Bandwidth policies define guaranteed and maximum bandwidth, per interface or per user; traffic shaping queues traffic during congestion.
- Application identification requires permitted traffic that traverses the inspection path; encrypted tunnels need decryption before identification.
- Hierarchical policies can cap a group and then allocate shares within it.
Worked example
Limit P2P traffic to 2 Mbps while guaranteeing 10 Mbps for ERP. Identify the P2P application group in the security policy, create a bandwidth policy with maximum 2 Mbps for that group, and a guaranteed 10 Mbps for the ERP application. Reasoning: port-based rules miss P2P because it changes ports and tunnels over HTTP, so application matching is required. The bandwidth policy then shapes the identified flows.
Traps that cost marks
- Using only port 80 to block video or P2P.
- Expecting a bandwidth policy to act on denied traffic.
- Confusing guaranteed bandwidth with maximum bandwidth.
- Ignoring inbound versus outbound direction.