Application filter keeps getting overwritten

Question

Hello. After importing some firewall rules from another XGS3300 running 19.5.0 over the weekend, each morning I'm coming in to find that we can't access the internet. When I check the application filter for "Block high risk (Risk Level 4 and 5) apps", which is the filter we are using for our web filtering firewall rule, all that's there is "All Applications". 
 I've fixed 2 days in a row by importing that filter set from the other firewall but I need a way to stop that filter from getting overridden.

Vivek Jagad · Accepted Answer

Hello FAAC Inc , Thank you for reaching out to the community, if you have applied both i.e. Web filtering and Application filtering in the FW rules, then according to the architect the application filtering has a higher precedence. So for example : some site or app is blocked in application and allowed in web filtering, then that site/app will be blocked as the application filtering has the higher precedence.

Vivek Jagad · Answer

Hey FAAC Inc , Thank you for the update, As Teams uses UDP Port for communication, On the CLI, select option 4.) Device console execute the following command:

Type: show advanced-firewall 
 The output shows the current UDP time-out value next to UDP timeout stream .

Type: set advanced-firewall udp-timeout-stream 300 
 
 Type: set advanced-firewall udp-timeout 300 This command increases the UDP time-out to 150 seconds. If your provider recommends a different value, use that. Ensure under the PROTECT > Intrusion Prevention > DoS & spoof Protection > DoS Settings > UDP flood is not enabled 
 Additionally you can also refer my recommended read - Sophos Firewall: How to prioritize the traffic via SD-WAN for the applications