Configuring DPI marking

Kaspersky SD-WAN supports creating firewall rules that are applied only to traffic packets of the specified application. You can specify the DPI marks that you want to govern which rules apply to which traffic packets.

You can configure DPI marking in a firewall template or on a CPE device. When you configure DPI marking in a firewall template, these settings are automatically propagated to all CPE devices that are using the template.

You cannot configure DPI marking if you disabled the DPI marking technology in basic firewall settings.

To configure DPI marking for the firewall:

1. Configure DPI marking for the firewall is applied in one of the following ways:
   • If you want to configure DPI marking for the firewall in a firewall template, go to the SD-WAN → Firewall templates menu section, click the template, and in the displayed settings area, select the DPI marking tab.
   • If you want to configure DPI marking for the firewall on a CPE device, go to the SD-WAN → CPE menu section, click the device, and in the displayed settings area, select the Firewall settings → DPI marking tab and select the Override check box.

   The DPI marking settings are displayed.

2. Select the check boxes next to the DPI marks which you want to govern which firewall rules apply to which traffic packets.
3. In the upper part of the settings area, click Save to save the settings of the firewall template or CPE device.