A security policy permits a named payroll application from a store to the VPC and denies other web. Users who browse by the application's name succeed. Users who use only the server's IP address are dropped. Why?
Select an answer to reveal the explanation.
Short Explanation
The rule recognizes the name and the users who typed a bare address never presented it. You permitted the named payroll application, so a raw IP address falls through to the deny. The tunnel is the same for both, and the match is what differs.
Full Explanation
An application-aware security rule matches the application identity, which is built from the name and related signatures. Users who browse by that name hit the permit. Users who connect only to the server IP address may never present the application identity, so they miss the permit and hit the deny for other web. The SIG tunnel is not up for one style of session and down for the other. The path is shared. OMP does not install the server only when a user types a name. The route is the same. A strict SLA does not distinguish a name from an IP address. It looks at path quality. Exam caveat: if the IP address must work, add an explicit prefix or port permit. Do not expect an application name to match a bare IP. Operational check: a connection by name should hit the permit counter, and a connection to the same server by IP should hit the deny until an IP rule is added.