The NSE 7 exam objective 4.2 demands that you understand how to control what applications people can use and which websites they can visit on a company network. Application control and web filtering are your digital bouncers: they decide what gets in and what stays out, protecting the business from threats and wasted productivity.
Jump to a section
A simple way to picture Application Control and Web Filtering
Have you ever wondered how a school librarian decides which books to let you read and which websites you can visit on the library computers?
The librarian has two important jobs: controlling what you can do online (application control) and deciding which websites are okay (web filtering). Imagine the librarian has a master list: ‘Students may only use educational apps like Google Docs and Khan Academy — no YouTube or Fortnite.’ That is application control. They stop you from opening a specific programme, just like your phone’s ‘Screen Time’ blocks games after 9 PM.
Now web filtering is like the librarian checking every book or website you try to bring into the library. If you try to access a site full of memes, the librarian says ‘Not allowed — that is a social media page, not a research resource.’ They look at the address (the URL) and the category (e.g., ‘Gaming’ or ‘News’) and either let you in or block you.
In a company network, the IT professional plays the role of that librarian. They set the rules: which applications (apps) are safe to use for work, and which websites could bring in viruses or waste time. The librarian (the firewall) enforces those rules every time you click. This keeps the whole office — just like the school library — a safe, productive place.
Let’s break down these two concepts from scratch. A company network is like a busy office building. Every employee uses a computer to do their job — sending emails, using accounting software, browsing the internet. Without rules, anyone could play video games, visit dodgy websites, or download malware. That is where application control and web filtering come in.
Application Control is the process of deciding which computer programmes (applications) are allowed to run on the network. Think of it as a doorman who checks the ID of every programme trying to access the internet. For example, an IT professional can create a policy that says ‘Allow Microsoft Teams and Zoom, but block TikTok and WhatsApp.’ The firewall (like a FortiGate) inspects the traffic not just by looking at the port number (like a door number), but by actually recognising the application’s unique ‘fingerprint’ — its traffic patterns, protocol, and behaviour. This is called Deep Packet Inspection (DPI). DPI looks inside the data packets (the digital envelopes) to see what application sent them, not just where they came from.
Web Filtering is about controlling which websites (Uniform Resource Locators, or URLs) users can visit. The firewall compares each requested URL against a database of categories — for instance, ‘Social Media’, ‘News’, ‘Gambling’, ‘Malware’. If a user tries to visit a site in the ‘Malware’ category, the firewall blocks it. If they try to visit Facebook, the policy might block it during work hours but allow it at lunchtime. This is managed via a web filtering profile that defines rules for each category.
Why do we need both? Because an application can be on a safe website and a dangerous website can host a safe application. For example, you might want to allow the Gmail application (for email) but block webmail sites (to prevent data leaks). Or you might want to allow access to Google Drive (an application) but block downloads of large files (a web filter rule). Together, they give the IT team fine-grained control.
FortiGate firewalls (the specific devices tested in NSE7) use something called the Application Control signature database. This is a constantly updated list of thousands of applications — from Netflix to Salesforce. When a packet arrives, the firewall checks it against this database. It also allows you to set ‘actions’ for each application: Allow, Block, or Monitor (log the activity without blocking). You can even apply different rules for different users or groups (using security profiles).
Web filtering works similarly. The firewall has a URL rating system. When a user requests a site, the firewall checks its local cache (a temporary storage of recently visited sites) or queries the FortiGuard cloud service (Fortinet’s online database) to get the category. Based on the policy, the firewall either allows it, blocks it, shows a warning page, or allows it but logs it.
Historically, IT teams used to block ports (like blocking port 80 for web traffic) to control access. But modern applications can use any port, shift their traffic to random ports, or even disguise themselves as web traffic (HTTP/HTTPS). That is why application control and web filtering are necessary — they look at the content, not just the port number. They replace the old ‘port blocking’ approach with intelligent, application-aware security.
For NSE7, you must understand how to configure these profiles on a FortiGate. You need to know the difference between an application control profile (which manages apps) and a web filter profile (which manages websites). You also need to know that both profiles are applied to a firewall policy — a rule that says ‘Traffic from this source to this destination is subject to these controls’. Without the correct profile attached, the firewall just lets everything through (or blocks everything).
A typical setup: You create an application control profile. You add Facebook, Twitter, and YouTube to a ‘Blocked’ list. You create a web filter profile. You set the ‘Social Media’ category to ‘Block’. Then you create a firewall policy that says ‘All internal users can go to the internet, but they must use this application control profile and this web filter profile.’ Now anyone on the network cannot access Facebook via the app or the website. That is the power of combining both.
Define the Goal
Before configuring anything, decide exactly what you want to control. For example, block the Facebook application and the Facebook website. This step defines the scope for your profiles.
Create an Application Control Profile
In the FortiGate interface, navigate to ‘Security Profiles’ > ‘Application Control’. Create a new profile. Search for the application (e.g., ‘Facebook’). Set its action to ‘Block’. Save the profile. This profile will control access to the Facebook app specifically (not the website).
Create a Web Filter Profile
Navigate to ‘Security Profiles’ > ‘Web Filter’. Create a new profile. Set the ‘Social Media’ category to ‘Block’ (this blocks all social media websites, including facebook.com). You can also add a specific URL filter for ‘facebook.com’. Save the profile. This profile controls access to the website.
Create or Edit the Firewall Policy
Go to ‘Policy & Objects’ > ‘IPv4 Policy’. Create a new policy. Set the source (e.g., ‘internal network’) and destination (e.g., ‘internet’). In the ‘Security Profiles’ section, enable ‘Application Control’ and select the profile you created. Enable ‘Web Filter’ and select the profile you created. This ties both profiles to the traffic flow.
Test and Verify
Have a user attempt to open the Facebook app on their computer, and also try to visit www.facebook.com in a browser. The app should be blocked (application control) and the site should be blocked (web filter). Check the log report under ‘Log & Report’ to verify that both blocks were logged correctly. Adjust the policy if needed (e.g., allow the site for a specific user group).
Configure Logging and Alerts
Set the policy to log ‘All Sessions’ (not just those that are blocked) for more detailed monitoring. Set up email alerts in ‘Event Log’ so you are notified when a block occurs. This helps you stay aware of attempted violations.
Imagine you are the new IT administrator for a medium-sized company called ‘GreenTech Ltd.’ They have 200 employees. The CEO tells you: ‘We keep getting distracted by YouTube. Also, someone almost downloaded a virus from a fake news site. Fix it.’
You log into the FortiGate firewall (the main security device that sits between the company’s internal network and the internet). Your first task is to create an application control profile. You go to the ‘Application Control’ menu. You search for ‘YouTube’. You see it listed as a known application. You set its action to ‘Block’. Next, you search for ‘TikTok’, ‘Facebook’, and ‘Netflix’. You block those too. You allow ‘Microsoft Teams’, ‘Zoom’, and ‘Outlook’ because the company needs them for work.
Your second task is to create a web filter profile. You go to ‘Web Filter’. You see categories like ‘Bandwidth Consuming’, ‘Social Media’, ‘Malware Sites’. You set ‘Malware Sites’ to ‘Block’. You set ‘Social Media’ to ‘Block’ during business hours (9:00 to 17:00) and ‘Monitor’ after hours. You also enable ‘URL Filter’ to block a specific domain like ‘example-bad-site.com’.
Now you apply these profiles to a firewall policy. You create a policy that says: ‘All traffic from the internal network (source) to the internet (destination) will use this application control profile and this web filter profile.’ You also set the policy to log all dropped connections so you can see who tried to access blocked content.
After you apply the policy, an employee named Sarah tries to watch a YouTube tutorial on a work project. The FortiGate sees the traffic matches the policy. It checks the application control profile — YouTube is blocked. The firewall drops the connection, and Sarah sees a block page saying ‘Access denied: YouTube’. Later, Sarah tries to visit a fake news site. The firewall’s web filter checks the URL rating. It sees the site is categorised as ‘Malware’. The connection is blocked, and an alert email is sent to you.
You, as the IT professional, would then review the logs. You might notice that Sarah tried to access YouTube three times. You could decide to allow YouTube only for certain departments (like marketing) by creating a separate policy for that group. This is a real-world, step-by-step use case.
Other common tasks include:
The NSE7 exam (specifically the ‘Fortinet NSE 7 - Advanced Security’ exam) will test your understanding of application control and web filtering in several ways. The questions are typically multiple-choice, scenario-based, or drag-and-drop. Here is what you need to know.
Question Types: - You will be given a network topology (a diagram of routers, firewalls, and PCs) and asked to configure a firewall policy to block a specific application or website. - You will be asked to identify which profile (application control vs. web filter) is used to solve a specific problem. - You will see questions about the order of operations: which happens first, application control or web filtering? (On a FortiGate, traffic is first matched to a firewall policy, then application control is applied, then web filtering.) - You will be asked to interpret logs: ‘A user tried to visit a site. It was blocked. Which profile blocked it?’
Common Traps: - They love to test the difference between blocking by category (web filtering) vs. blocking by application (application control). For example, a question might say ‘Block Facebook.’ The answer could be either — you must decide if they mean the Facebook app (application control) or the facebook.com URL (web filter). Some questions explicitly say ‘using the web filter’ to force that answer. - Another trap: ‘Application control is independent of the firewall policy.’ That is false. Application control profiles are tied to firewall policies. Without a policy, they do nothing. - They might show a configuration where the application control profile blocks an app but the web filter profile allows the website. The firewall will block the app because application control is evaluated before web filtering. Understand the order.
Concepts to Memorise: - The difference between ‘deep packet inspection’ and ‘port-based’ filtering. - That Fortinet’s cloud-based rating service is called ‘FortiGuard’ (not FortiClient or FortiGate). - The default action for applications in a profile: by default, ALL applications are allowed. You must explicitly block or monitor. - Web filtering has a ‘Rate by HTTP’ option that uses actual URL content, not just the domain. - You can create ‘exemptions’ in web filtering to override a category block for specific URLs.
What They Love to Test: - The ‘Allow, Monitor, Block’ actions in application control. ‘Monitor’ will log but not block. - The concept of ‘profile override’: a user can be exempt from a profile if they are in a different group. - The six web filter categories: ‘Malware’, ‘Spam’, ‘Phishing’, ‘Social Media’, ‘News’, and ‘Not Rated’. For ‘Not Rated’, you can set a default action (allow or block). - That SSL inspection (looking inside encrypted web traffic) is required for application control to work on HTTPS traffic. Without SSL inspection, the firewall sees ‘encrypted’ and cannot identify the application.
For the exam, one key sentence to remember: ‘Application control identifies and controls applications by their traffic signatures, not their port numbers.’ Another: ‘Web filtering identifies and controls websites by their URL category.’ The exam expects you to recall these definitions precisely.
Application control identifies and controls applications by analysing their unique traffic signatures, not by port numbers.
Web filtering controls access to websites by checking URLs against a database of categories (e.g., Malware, Social Media).
Both application control and web filtering must be assigned to a specific firewall policy to take effect.
The default action in an application control profile is to allow all applications — only explicitly blocked or monitored apps are affected.
On a FortiGate, application control is evaluated before web filtering within a single firewall policy.
SSL inspection (decrypting HTTPS traffic) is required for application control to work on encrypted web traffic.
You can block a website with web filtering while still allowing its associated application (or vice versa) by applying both profiles differently.
FortiGuard is the cloud-based service that maintains the URL rating database and application signatures used by FortiGate.
These come up on the exam all the time. Here's how to tell them apart.
Application Control
Controls applications (programmes) like TikTok, Netflix, Microsoft Teams based on traffic signatures.
Uses an application control profile within a firewall policy.
Requires SSL inspection to identify applications over HTTPS traffic.
Web Filtering
Controls websites (URLs) like tiktok.com or netflix.com based on URL categories.
Uses a web filter profile within a firewall policy.
Can block websites by URL or category without SSL inspection (but category accuracy improves with it).
Firewall Policy
Defines the traffic flow: which source can communicate with which destination (e.g., internal users to internet).
Determines what actions (allow, deny, etc.) are taken on the traffic.
Can include multiple security profiles (like application control and web filter) attached to it.
Security Profile
Defines the specific security controls (e.g., which applications to block, which websites to filter).
Does not control traffic flow — it only inspects traffic that matches the policy it is attached to.
Each profile (application control, web filter, intrusion prevention, etc.) is a separate object that can be reused across policies.
FortiGuard Category (Web Filter)
Classifies websites by their content (e.g., 'Social Media', 'Malware', 'News').
Used in the web filter profile to decide whether to block or allow a website.
Database is maintained by FortiGuard's cloud service and updated regularly.
Application Signature (App Control)
Classifies applications by their network behaviour (e.g., traffic pattern, ports, payload).
Used in the application control profile to decide whether to block or allow an application.
Database includes thousands of applications and is also updated via FortiGuard.
Allow Action (App Control)
Permits the application to run without any restriction.
Does not log the activity (unless logging is enabled separately on the policy).
The default action for all applications in a new profile unless you specify otherwise.
Monitor Action (App Control)
Permits the application to run but logs all usage for later review.
Useful for assessing which applications are being used before deciding to block them.
Does not affect performance, but generates log entries that can be viewed in Log & Report.
Mistake
Application control and web filtering are the same thing — they both block websites.
Correct
They are different. Application control blocks specific applications (like the Facebook app) based on traffic signatures, while web filtering blocks websites (like facebook.com) based on URL categories.
Beginners often think ‘block Facebook’ means the same thing in both contexts, but the technical implementation and the exact traffic they control are distinct.
Mistake
If you block an application using application control, you don’t need web filtering because the app can’t run anyway.
Correct
An application may be used through a browser (e.g., Facebook accessed via a web browser). Blocking the Facebook app won’t stop someone from using the Facebook website. You need both profiles for complete control.
Many people assume each service is tied to one method of access, but modern web apps can be accessed via dedicated applications or web browsers.
Mistake
Web filtering works by checking the IP address of the website, so a change in IP address will bypass the filter.
Correct
Web filtering primarily checks the URL (domain name) against a category database, not just the IP address. Even if an IP changes, the domain name is still blocked.
This confusion comes from older network concepts where blocking was done by IP address. Modern web filtering works at a higher level (Layer 7) and uses domain names.
Mistake
Application control only works on known, popular applications (like Facebook or YouTube) and cannot detect custom or obscure apps.
Correct
FortiGate’s application control can detect applications based on a wide range of signatures, including custom applications if you define them. It also learns new signatures via FortiGuard updates.
A common beginner assumption is that only big companies have their apps recognised, but the database includes thousands of applications and supports custom signatures for enterprise software.
Mistake
Both application control and web filtering are applied to all traffic automatically once you enable them globally on the firewall.
Correct
They must be explicitly assigned to a firewall policy. Without a policy, they have no effect. You create a profile, then attach it to the specific policy that governs traffic from a source to a destination.
Newcomers often think firewall features are ‘always on’ by default, but FortiGate requires deliberate configuration per policy.
Mistake
SSL inspection is optional and does not affect how application control or web filtering work.
Correct
For application control to inspect HTTPS traffic (encrypted web traffic), SSL inspection must be enabled. Without it, the firewall cannot see inside the encrypted stream to identify the application.
Because HTTPS is encrypted, the firewall would only see ‘encrypted traffic’ and cannot determine whether it is YouTube or Google Docs. SSL inspection decrypts the traffic for analysis.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Application controls which applications (like the TikTok app) are allowed to run, based on their traffic signatures. Web filtering controls which websites (like tiktok.com) are allowed to be visited, based on URL categories.
It can, but only if you enable SSL inspection (deep packet inspection) on the firewall policy. Without SSL inspection, FortiGate cannot see inside the HTTPS stream to identify the application.
Yes. For example, you can block ‘facebook.com’ using web filtering but allow the Facebook Messenger app using application control. You just need to configure both profiles appropriately in the same firewall policy.
Check that you have applied the application control profile to the correct firewall policy. Also verify that SSL inspection is enabled if the app uses HTTPS. Without inspection, the firewall cannot identify the application.
No. You create one application control profile that lists all the applications you want to block. Then you apply that profile to any firewall policy that governs traffic from a source to a destination.
It is labelled as ‘Not Rated’. You can configure the web filter profile to either block or allow ‘Not Rated’ sites (by default, FortiGuard will block them if you set the action to ‘Block’ for unrated). You can also enable ‘Allow when FortiGuard is unreachable’ to prevent downtime.
You've finished Application Control and Web Filtering. Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?