Firmware Version dependent Behavior of Application Control

The CGF recognizes four application categories: custom network apps (Layer 3/4 IP/port), custom web apps and built-in web apps (Layer 7 HTTP host/URL or SNI), and Pace2 apps (DPI protocol signatures). Each category has distinct detection rules and precedence behavior, which changed significantly in firmware 10.5.

Duplicate Custom Network Applications

Custom network apps are duplicates if they share all of the following endpoint attributes:

Layer 4 protocol (Any, TCP or UDP)
Destination address
Destination port range

Hostname-based custom network apps are resolved to IP addresses internally, so duplicates can arise inadvertently if:

a hostname-based app resolves to the same IP address as another existing address, or
two hostname-based apps with different hostnames resolve to the same IP address.

< 10.5	>= 10.5

< 10.5	>= 10.5
Only the first encountered custom network app for a given endpoint was considered by the engine, all others were silently dropped.	Up to eight custom network apps can exist for the same endpoint. The ninth and further ones are silently dropped.

Overlapping Custom Network Applications

Custom network apps can have overlapping ranges, for example:

tcp:192.168.0.0/16:0-65535 and tcp:192.168.1.0/24:0-65535, or
tcp:192.168.1.1:0-1024 and tcp:192.168.1.1:80,443

In both cases, a session matching the second app also matches the first.

< 10.5	>= 10.5

< 10.5	>= 10.5
Only the most specifically defined app was assigned to the session — the one with the smallest address range, or if equal, the smallest port range.	All matching apps are assigned to the session (at most 16; see below).

Multiple Applications Matching in the Same Session

< 10.5	>= 10.5

< 10.5	>= 10.5
Only one app (a hierarchy of up to 3 app-IDs) could be assigned to a session at any point in time. A newly detected app fully overwrote the existing one.	Up to 16 app-IDs can be assigned to a session. Newly detected app-IDs are appended. If all 16 slots are filled, new app-IDs overwrite the oldest ones.

Restrictions between Applications

When multiple applications are involved, specific restrictions may apply.

< 10.5	>= 10.5

< 10.5	>= 10.5
A matching custom network application prevents any further application and protocol detection for the whole session. A matching custom web app prevents detection of built-in web apps for the same request; built-in web apps can still match for later requests in the same session. Pace2 apps can match at any time.	A matching custom web app prevents detection of built-in web apps for the same request; built-in web apps can still match for later requests in the same session. Pace2 apps can match at any time.

Handling of Multiple Applications for the Same Hostname

Multiple Custom Network Apps for the Same Hostname

Multiple custom network apps for the same hostname resolve to the same IP address(es). If the other attributes (Layer 4 protocol and port range) are also identical, the rules for duplicate and overlapping apps described above apply.

Multiple Custom Web Apps for the same Hostname

Not allowed — prevented by a validation check in Firewall Admin.

A Custom Network Application for the same Hostname as a Custom Web Application or Built-in Web

Custom Network Applications and Web Applications (ordinary and custom) can coexist under these conditions:

< 10.5	>= 10.5

< 10.5	>= 10.5
The custom network app matches and prevents any further application detection, so the web app (custom or built-in) will not match.	Both the custom network app and the web app (custom or built-in) match, subject to the restrictions in the following section.

A Custom Web Application for the same Hostname as a Built-in Web App

This behavior is the same in all firmware versions. A custom web app and a built-in web app can coexist on the same session: if a custom web app matches a request, built-in web apps are not checked for that same request but can still match for subsequent requests. The same applies to SNI-based detection.

As a result, custom web apps can be used to override built-in web apps on a per-request basis.

A custom web app may have path conditions. In that case it suppresses built-in web app detection only if ALL conditions of the custom web app match — a matching host/domain condition alone is not sufficient.

Pace2 Apps

Pace2 apps are fully independent of all other application types: they can match at any time and impose no restrictions on subsequent detection.

Exception: in firmware < 10.5, a matching custom network app prevented all application detection, including Pace2 apps.

Visualizations in Barracuda Firewall Admin

The Firewall Admin Live > Show Session Details… panel has been extended (since 10.5) to show all app-IDs (up to 16) assigned to a session.

< 10.5	>= 10.5

< 10.5	>= 10.5
The Live view always shows the base app (lowest hierarchy level) assigned to the session.	The Live view shows the app that caused the app condition of the most recent application rule evaluation to match. If multiple apps in the session could have caused the match, the first one encountered is shown.