Configuring a Predefined Application

This section describes how to configure the application identification mode, predefined applications, port mapping, and SA parameters.

Context

Multiple well-known applications are predefined on the FW. You can query details on applications to help reference applications correctly in policies, for details to reference Mechanism.

Predefined applications support port mapping. If a user uses an ephemeral port for a well-known service, enable the port mapping function for the FW to identify the well-known service and accurately process the service data.

Procedure

Configure the application identification mode.
In the system view, set the application identification mode to full identification.

sa force-detection enable

Or, in the system view, set the application identification mode to smart identification.

undo sa force-detection enable
- Intelligent Identification: in this mode, the FW identifies the applications of matching traffic only when the application identification policy or content security detection function is configured.
- Full Identification: in this mode, the FW identifies the applications of all traffic, which deteriorates performance.
Query the details on a predefined application.
display application [ pre-defined | name name ]
Configure port mapping.
In the system view, configure port mapping.

port-mapping application-name port port-number acl acl-number

Set SA parameters.

Access the SA view from the system view.
sa

Set SA parameters.

Item	Command
Enable application identification acceleration.	sa cache [ risk-level { low \| high } ] enable
Set the aging time of the predefined application identification correlation table.	application name name cache type { acceleration aging-time aging-time \| multi-channel aging-time aging-time }
Set the threshold of packet quantity for the SA module to enable port identification.	port-identification packet-number-threshold packets
Set the maximum number of bytes of sessions that can be detected by the SA module.	detect max-bytes max-bytes
Set the maximum number of packets of sessions that can be detected by the SA module.	detect max-packets max-packets
Set the maximum duration in which the SA module detects sessions.	detect max-time max-time
Enable unidirectional detection for the SA module.	detect uni-direction