[AF] Application filtering IP shows inaccurate application control Policies configuration issues

Problem Description

If you filter the IP Application, you cannot see the traffic of applications such as QQ, but if Statistics filter the traffic statistics in the traffic Statistics, you can see it;

Application:

Traffic:

Effective troubleshooting steps

1. Check the AF configuration and find that the application control Policies is based on Policies Services, not the application;
   
2. The F (traffic audit) table is queried in application statistics. There are application fields in the table, which means that statistics can be Statistics normally:
   

Root cause

1. The application control Policies is to Services.
2. The data queried in Application is table F, and the data queried in traffic Statistics is table A and table F;
3. Table A: Application Control Logs table, Table F: Traffic audit

solution

After changing the application control policy to use Policies as Policies, it works normally. You need to confirm with the customer whether the modification can be made. If you make a rejection policy based on Policies, there may be a problem of letting the first packet pass.

Original Link

https://support.sangfor.com.cn/cases/list?product_id=13&type=1&category_id=1113&isOpen=true