Best practices for Application Control and Web Filtering-Cloud Firewall(Cloud Firewall)-阿里云帮助中心

This topic provides configuration examples for Application Control and Web Filtering to help you implement fine-grained, application-layer access control over your network traffic.

Prerequisites

Before you use Application Control and Web Filtering, you must enable these features. They are currently in an invitation-only preview. To enable them, contact your account manager and provide the test region and IP addresses.
Application Control uses TLS inspection for deep identification of HTTPS traffic, and Web Filtering uses it to match HTTPS URL paths. If you need to inspect encrypted traffic, ensure that TLS inspection is configured and enabled for the target asset.

How it works

Application Control uses deep packet inspection (DPI) and heuristic behavior analysis to identify the true application identity within traffic, even when it is encrypted or uses non-standard ports. Its built-in signature library covers 22 major application categories, such as office collaboration, instant messaging, artificial intelligence, network tunneling, and development and design. You can use it to allow, monitor, or deny outbound traffic based on application type.

Web Filtering performs allow, monitor, or deny actions on outbound HTTP/HTTPS requests based on URL pattern matching of hostnames and paths. It also supports wildcards for fine-grained, path-level control.

To use these features, create a security template and reference it in the Advanced Settings of an outbound access control policy. Advanced settings are counted against a separate quota, with a limit of 10 templates.

You can reference a disabled security template in an access control policy. In this case, the engine identifies the relevant advanced security fields in flow logs but does not perform any control actions or generate event logs.

Matching logic

Web filtering matching logic

The target URL for Web Filtering consists of a hostname (domain name) and a path. When multiple URL rules are configured for the same domain, the system applies the longest-prefix match principle, where the rule with the longer matching path takes precedence.

Note

The URL path must end with a /. For example, example.com/ is correct, while example.com is incorrect.
The target URL supports only a hostname and path. It does not support protocol prefixes (such as https://), query parameters, or fragments.
Use a wildcard (*) only at the end of a path, and include only one wildcard per rule.
Duplicate URL rules are not allowed within the same security template.
If a URL does not match any rule, the engine allows the traffic by default.

Application control matching logic

After performing deep packet inspection (DPI) analysis on outbound traffic, the system may identify multiple application tags for a single connection. The final action follows this order of precedence, from highest to lowest:

Custom rule: Highest precedence. You can set a specific action for an application. Rules with a lower priority value are matched first. A single custom rule with the same priority can be associated with up to 100 applications.
Built-in application categories: If a request matches multiple application tags, the system applies the action of the application with the highest weight.
Unrecognized application action: The fallback action for applications that the signature library cannot identify.

Note

Use built-in application categories as the primary control method. Custom rules should be used mainly for temporary mitigation, operational tasks, or to apply different, higher-precedence controls to specific applications within a category.
For long-lived connections over HTTP, including HTTPS with TLS inspection, the identification result is dynamically updated with each new request.
For non-HTTP protocols, identification occurs only once when the connection is established and is not updated afterward.

Coordinated evaluation logic for access control and advanced settings

The system first evaluates basic access control policy conditions, such as source, destination, protocol, port, and application, with an "AND" logic.

Coordinated evaluation rules

The original access control matching logic applies. If traffic matches a policy, the system takes the policy's basic action.
If traffic matches the basic access control conditions, it proceeds to the advanced security matching stage. If it matches an advanced security rule, the action from the advanced security template takes precedence. Web Filtering rules have higher priority than Application Control rules.

Note

When Web Filtering does not match a specific rule, the default action is to allow the traffic. Application Control then processes the traffic.
Referencing a disabled security template does not affect the policy's basic matching and action. Flow logs still record the identification results, but the template does not enforce any controls or generate event logs.
Multiple access control policies can reference the same Application Control or Web Filtering template.

Web Filtering configuration examples

Allow a domain but deny a specific path

Example: An organization wants to allow employees to browse code repositories and download release files from github.com but prohibit them from uploading files to a specific repository through the GitHub web interface.

Procedure:

Log on to the Cloud Firewall console.
In the left-side navigation pane, choose Protect > Web Filtering.

Click Create Template and configure the following parameters.

Parameter	Description
Template Name and Template Description	Enter an easy-to-identify name and description, such as `GitHub Path Control`.
Template Switch	Enable the switch to activate the template.
Custom Rules	Configure the following two URL rules. Rule 1 Target URL: `github.com/example-org/example-repo/upload/` Action: Deny Description: Denies file uploads to the specified repository through the web interface. Replace `example-org/example-repo` with your actual organization and repository names. Rule 2* Target URL: `github.com/` Action: Allow Description*: Allows all other access to GitHub, including browsing repositories and downloading release files.

After the security template is created, in the left-side navigation pane, choose Protect > Access Control > Policy Configuration > Internet Border.

On the Outbound tab, click Create Policy. In the Create Outbound Policy panel, configure an access control policy and reference the template you created in Advanced Configuration. The key parameters are as follows:

Parameter	Description	Example value
Source	The traffic initiator.	0.0.0.0/0
Destination	The traffic recipient.	0.0.0.0/0
Protocol	The transport layer protocol.	TCP
Port	The destination port range.	0/0
Action	The action for the policy.	Allow
Advanced Configuration - Web Filtering	Select the Web Filtering template you created.	GitHub Path Control

Verification: After the configuration is complete, verify that you can browse repository pages on github.com and download release files, but cannot upload files to the specified repository through the web interface.

Application Control configuration examples

Manage shadow AI: Allow only approved AI tools

Example: An organization has approved Qwen and Alibaba Cloud Model Studio as its internal AI tools. It needs to prohibit employees from using unapproved AI applications, such as ChatGPT, Claude, and Gemini, while retaining the ability to monitor unknown applications.

Procedure:

In the left-side navigation pane, choose Protect > Access Control > Application Control.

On the Custom Template tab, click Create Template and configure the following parameters.

Parameter	Description
Basic Information	Enter an easy-to-identify name and description, such as `AI Tool Control`.
Built-in Application Classification	In the category list, locate Artificial Intelligence and use Bulk Actions to set the action to Deny. This blocks matching requests and records event logs.
Custom Rules	Rule 1: Allow approved AI tools and log events to track usage. Custom rules have higher precedence than built-in categories, so this rule is not affected by the "Deny" action set for the Artificial Intelligence category. If you do not need logs, you can change the action to Allow. Action: Monitor Rule Priority: 10 Select Application: Model Studio, Qwen
Unknown Application Action	Defines the default action for unknown applications. Set it to Monitor to prevent business disruptions by allowing traffic from unknown applications. This also helps you discover new AI applications through logs.
Template Switch	Enable the switch to activate the template.

After the security template is created, in the left-side navigation pane, choose Protect > Access Control > Policy Configuration > Internet Border.

Parameter	Description	Example value
Source	The traffic initiator.	0.0.0.0/0
Destination	The traffic recipient.	0.0.0.0/0
Protocol	The transport layer protocol.	TCP
Port	The destination port range.	0/0
Action	The action for the policy.	Allow
Advanced Configuration - Application Control	Select the Application Control template you created.	AI Tool Control

Note

The basic policy action is set to Allow. When an advanced security rule is matched, the action from the Application Control template takes precedence.
Multiple policies can reference the same Application Control template. You do not need to create a separate template for each access control policy.

Verification: After configuration, we recommend monitoring the system for one to two weeks. Go to Log Audit > Event Logs to view matching events for the "Artificial Intelligence" application category and assess the actual usage of AI applications within your organization. After the assessment, you can adjust the control actions for the built-in category as needed. Add custom rules only for special operational tasks or to implement differentiated controls.

Control developer tools and prevent code exfiltration

Example: An organization needs to ensure its development team can use tools like GitHub and Ant Engineer Portal, but it must prohibit file uploads to GitHub to prevent source code from being leaked to public repositories.

Procedure:

In the left-side navigation pane, choose Protect > Access Control > Application Control.

On the Custom Template tab, click Create Template and configure the following parameters.

Parameter	Description
Basic Information	Enter an easy-to-identify name and description, such as `Developer Tool Control`.
Built-in Application Classification	In the category list, click More, locate Development and Design, and use Bulk Actions to set the action to Allow. Then, within the Development and Design category, search for "GitHub Upload," and set the action for this application to Deny. Note The "Development and Design" category covers applications like GitHub and Ant Engineer Portal. Setting it to Allow ensures development productivity.
Custom Rules (Optional)	For temporary mitigation, operational tasks, or to ensure that "GitHub Upload" takes precedence over other identification results in the category, you can use a custom rule. For example: Rule 1: Temporarily or with higher priority, prohibit code uploads through GitHub. Action: Deny Rule Priority: 10 Select Application: GitHub Upload
Unknown Application Action	Defines the default action for unknown applications. Set it to Monitor.
Template Switch	Enable the switch to activate the template.

After the security template is created, in the left-side navigation pane, choose Protect > Access Control > Policy Configuration > Internet Border. Continue to configure an access control policy. For details, see Manage shadow AI: Allow only approved AI tools.
Verification: After the configuration is complete, verify that developers can browse GitHub repository pages, but file upload operations through GitHub are blocked.

Combined examples for Application Control and Web Filtering

Tiered control for AI tools

Example: An organization needs to implement tiered control for AI tools: allow approved tools (like Qwen and Alibaba Cloud Model Studio), deny unapproved ones, and also block the upload of model files to AI model hosting platforms by matching specific URLs.

Procedure:

Create a Web Filtering template.

In the left-side navigation pane, choose Protect > Web Filtering.

Click Create Template and configure the following parameters.

Parameter	Description
Template Name and Template Description	Enter an easy-to-identify name and description, such as `AI Platform URL Control`.
Template Switch	Enable the switch to activate the template.
Custom Rules	Configure the following three URL rules. Rule 1 Target URL: `chat.openai.com/` Action: Deny Description: Provides fallback protection by blocking access to ChatGPT through URL matching. Rule 2* Target URL: `huggingface.co/example-org/example-model/upload/` Action: Deny Description: Blocks file uploads to a specific Hugging Face model repository. Replace `example-org/example-model` with your actual organization and model names. Rule 3* Target URL: `huggingface.co/` Action: Monitor Description: Allows browsing on Hugging Face and records logs. Note* To control multiple model repositories, add a separate upload path rule for each repository. Make sure each rule contains at most one wildcard and that the wildcard is at the end of the path. Duplicate URL rules are not allowed within the same security template.

Create an Application Control template. Following the steps in Manage shadow AI: Allow only approved AI tools, create an Application Control template named AI Tool Control. If you need to apply different actions to approved and unapproved AI applications, add custom rules with different priorities.

Create an outbound access control policy that references both templates.

In the left-side navigation pane, choose Protect > Access Control > Policy Configuration > Internet Border.

On the Outbound tab, click Create Policy. In the Create Outbound Policy panel, configure an access control policy and reference the templates you created in Advanced Configuration. The key parameters are as follows:

Parameter	Description	Example value
Source	The traffic initiator.	0.0.0.0/0
Destination	The traffic recipient.	0.0.0.0/0
Protocol	The transport layer protocol.	TCP
Port	The destination port range.	0/0
Action	The action for the policy.	Allow
Advanced Configuration - Web Filtering	Select the Web Filtering template you created.	AI Platform URL Control
Advanced Configuration - Application Control	Select the Application Control template you created.	AI Tool Control

Note

When you apply both Application Control and Web Filtering to a policy, Web Filtering rules have higher priority. The system first evaluates a request against Web Filtering rules. If the request does not match a URL rule, the system then processes it using Application Control results.

Verification: After the configuration is complete, verify the following results:
- Access to Qwen and Alibaba Cloud Model Studio is allowed.
- Unauthorized AI applications (such as ChatGPT and Claude) are blocked by Application Control rules.
- Access to chat.openai.com is blocked as a fallback by a Web Filtering rule.
- Access to huggingface.co is allowed and logged, but requests to its upload path are blocked.

End-to-end control for developer environments

Example: An organization needs to ensure its development team can use necessary tools while preventing code and sensitive data leakage through both application identification and URL matching.

Procedure:

Create a Web Filtering template.

In the left-side navigation pane, choose Protect > Web Filtering.

Click Create Template and configure the following parameters.

Parameter	Description
Template Name and Template Description	Enter an easy-to-identify name and description, such as `Developer Platform URL Control`.
Template Switch	Enable the switch to activate the template.
Custom Rules	Configure the following URL rules. Rule 1 Target URL: `npmjs.com/` Action: Allow Description: Allows the use of the npm package manager. Rule 2* Target URL: `pypi.org/` Action: Allow Description: Allows the use of the Python package manager. Rule 3* Target URL: `pastebin.com/` Action: Deny Description: Prevents code snippets from being uploaded to Pastebin. Rule 4* Target URL: `transfer.sh/` Action: Deny Description: Prevents file exfiltration through transfer.sh. Rule 5* Target URL: `github.com/example-org/example-repo/upload/` Action: Deny Description: Blocks file uploads to a specific GitHub repository through the web interface. Replace `example-org/example-repo` with your actual organization and repository names. Rule 6* Target URL: `github.com/` Action: Allow Description: Allows general access to the GitHub domain. Note* Web Filtering follows the longest-prefix match principle. The upload path rule for the specific repository is more specific than `github.com/*`, so web upload actions are denied, while browsing repositories and downloading release files are allowed. To control multiple repositories, add a separate upload path rule for each one.

Create an Application Control template. Following the steps in Control developer tools and prevent code exfiltration, create an Application Control template named Developer Tool Control.
Following the steps in Tiered control for AI tools, create an outbound access control policy that references both the Developer Tool Control and Developer Platform URL Control templates.
Verification: After the configuration is complete, verify the following results:
- Developers can browse GitHub repository pages and use package managers like npm and pip.
- The Application Control rule blocks GitHub file upload requests. When you upload files to the target repository through a browser, the request also matches the Web Filtering deny rule.
- Requests to unauthorized content platforms like pastebin.com are blocked.

Recommendations

Recommendation	Description
Monitor first, then tighten	When creating a new security template, set the initial action to "monitor". After one to two weeks of operation, analyze the actual traffic distribution based on event logs in Log Audit, then gradually change the action to "deny". This approach avoids blocking legitimate business traffic when the policy is first deployed.
Prioritize built-in categories	When setting a baseline action, prioritize the built-in categories in Application Control. Use custom rules only for temporary mitigation, operational intervention, or to apply different, high-precedence controls for specific applications.
Use Application Control and Web Filtering together	Application Control provides control based on application identity, while Web Filtering provides supplemental control based on URL paths. When both are configured, Web Filtering rules have higher matching priority than Application Control rules. If an advanced security rule is matched, the action from the advanced security template takes precedence.
Enable TLS inspection first	Deploy TLS inspection before you configure Application Control and Web Filtering. Without TLS inspection, Application Control can only perform limited identification based on SNI, and Web Filtering can only match hostnames, not specific paths.
Set unrecognized application action to monitor	Set the Unknown Application Action in Application Control to "monitor". This avoids business disruptions caused by blocking unknown traffic and helps you discover new applications not yet covered by the signature library through logs.
Reuse security templates	Referencing an advanced security template does not affect access control policy specifications. Multiple access control policies can reuse the same template. Advanced security configurations are subject to a quota of 10 templates.
Review logs regularly	Regularly review rule matches and traffic distribution in Log Audit > Event Logs. This practice helps you discover abnormal traffic patterns or unauthorized applications and continuously optimize your policy configurations.

上一篇: Web filtering 下一篇: FAQ about access control policies