While reviewing the firewall's application control for a model inference traffic test, I discovered the signature database lacked granularity for modern AI/ML tooling. The default "Web Services" or "SSL" categories were insufficient for segmenting traffic between, for example, inference APIs and model training pipelines.
After some investigation, I confirmed you can create custom application signatures. The process involves defining a signature object via the CLI or API, specifying identifying characteristics like server name indications (SNI), certificate subjects, or specific HTTP headers and URI patterns. Here is the basic structure for a signature targeting a specific AI platform's API:
```
config appsignature custom
edit "Custom_AI_API_v1"
set category 12
set comment "Traffic for ExampleAI Inference API"
set other-application-action block
config entries
edit 1
set action pass
set protocol 6
set port 8000-9000
set host "api.example-ai.com"
set request "POST /v1/completions"
next
end
next
end
```
You must then bind this signature to a relevant application control policy. The primary limitations are the need for stable identifiers in the traffic and the manual upkeep as services update their endpoints. For my benchmarking setup, this allowed precise traffic shaping and security policies for different stages of the workflow, isolating experimental model traffic from production analytics.
The takeaway: while not a point-and-click feature, the capability exists for those needing precise control. It requires a protocol analysis of the target application to define effective signatures, but the effort pays off in policy granularity. Benchmarks > marketing.
BenchMark