Cisco Cisco Firepower Management Center 4000

Optionally, click the 

 prompt above the 

 list, then type a name or 

value.

The list updates as you type to display matching conditions. See 

 

for more information.

Click a condition in the 

 list. Use the Shift and Ctrl keys to select multiple conditions, or 

right-click and then click 

.

Conditions you select are highlighted.

You have the following choices:

Click 

.

Drag and drop selected conditions into the 

 list.

Conditions you selected are added.

Save or continue editing the rule.

You must apply the access control policy for your changes to take effect; see 

.

Control

Series 3, Virtual, X-Series, ASA FirePOWER

You can configure access control rules to match application traffic. You can use either individual 
applications or application filters, either Cisco-provided and user-defined, as conditions for an access 
control rule. You can add applications and filters, in any combination, as long as the total number of 
items does not exceed 50, where a filter counts as a single item. If the existing filters do not meet your 
needs, you can create an application filter on the fly while creating an application condition; you can 
then use the new filter in your rule and in other existing and future rules. See the following sections for 
more details:

For information on Cisco-provided and user-defined applications, see 

For information on Cisco-provided and user-defined application filters, see 

.

For information on adding an application filter on the fly, see 

Note the following when adding applications:

The system applies the default policy action to packets that do not have a payload in a connection 
where an application is identified; this would be the case, for example, when a TCP connection is 
being established.

It is not possible to identify applications or filter URLs before a connection is established between 
the client and the server. Therefore, when a packet matches all the other conditions in a rule 
containing an application or a URL, if application identification has not been completed, the packet 
is allowed to pass. This behavior allows a connection to be established so that applications can be 
identified.