Description
When the same firewall policy applied with application control along with web-filter in proxy mode no replacement message will be generated for application control.
Application control works only on flow based and web filter can be proxy or flow based. When web filter is proxy based, the proxy will do SSL inspection and decoded data will be sent to IPS for application control.
Solution
Configure web filter in flow based instead of proxy based. When web filter is flow based, together with AppCtrl, traffic will be processed inside the IPS engine, including SSL inspection.
config webfilter profile
edit <profile name>
set inspection-mode flow-based
end
end
