Default elements for network applications

There are several predefined elements for working with network applications.

Application Type elements define general categories of network applications. One Application Type element can be associated with each Network Application element. Application Type elements are predefined, and you cannot create Application Type elements.

Tag elements help you to create simpler policies with less effort. Tag elements represent all Network Application elements that are associated with that Tag. For example, the Media Tag includes several web-based image, music, and video applications. Several Tags can be associated with each Network Application element.

Dependencies for network applications define other network applications that must also be allowed when the network application is allowed. When you use a network application that has dependencies in a rule with the Allow or Jump action, or in a NAT rule, the rule also applies to the related network applications. When you use the network application that has dependencies in a rule with the Continue, Discard, or Refuse action, the rule does not apply to the related network applications.

TLS Match elements define matching criteria for the use of the TLS protocol in traffic. When a connection that uses the TLS protocol is detected, the server certificate for the connection is compared to the TLS Match in the Network Application definition. TLS connections are allowed only to sites that have trusted certificates that meet the following criteria:

• The certificate domain name must match the domain name in the TLS Match element.
• The certificate must be signed by a valid certificate authority.
• The certificate must be valid (not expired or revoked).

TLS Match elements can also specify whether to decrypt TLS traffic to particular Internet domains for inspection. The default TLS Match elements deny decryption of only the following types of traffic:

• Traffic for Network Applications that do not work correctly if the traffic is decrypted.
• Traffic that is functionally critical, such as connections to the Forcepoint Advanced Malware Detection service, or to services for automatic dynamic updates and engine upgrades.

For more information, see Knowledge Base article 18074.

The predefined elements are imported and updated from dynamic update packages. The set of elements available changes whenever you update your system with new definitions. The Release Notes of each dynamic update package list the new elements that the update introduces.