Needed to lock down access to Salesforce but still allow our marketing team to use specific approved apps within it (like Pardot). The default "junos-web" and "junos-salesforce" application IDs are too broad. Here's how to build a custom AppSecure policy for granular control.
**1. Define the custom application.** You need the specific hostnames Salesforce uses.
```
set applications application CUSTOM-Salesforce term 1 protocol tcp
set applications application CUSTOM-Salesforce term 1 destination-port 443
set applications application CUSTOM-Salesforce term 1 destination-address pardot.lightning.force.com
set applications application CUSTOM-Salesforce term 1 destination-address login.salesforce.com
```
Add all required domains your team uses.
**2. Create the AppTrack and AppFW policy.**
```
set security policies from-zone trust to-zone untrust policy SALESFORCE-OUT match source-address any
set security policies from-zone trust to-zone untrust policy SALESFORCE-OUT match destination-address any
set security policies from-zone trust to-zone untrust policy SALESFORCE-OUT match application CUSTOM-Salesforce
set security policies from-zone trust to-zone untrust policy SALESFORCE-OUT then permit application-services application-track
set security policies from-zone trust to-zone untrust policy SALESFORCE-OUT then permit application-services application-firewall rule-set SALESFORCE-RULES
```
**3. The AppFirewall rule-set to block unwanted app-ids.**
```
set applications application-firewall rule-set SALESFORCE-RULES rule BLOCK-DEFAULT match dynamic-application junos-web
set applications application-firewall rule-set SALESFORCE-RULES rule BLOCK-DEFAULT then reject
set applications application-firewall rule-set SALESFORCE-RULES rule PERMIT-CUSTOM match dynamic-application CUSTOM-Salesforce
set applications application-firewall rule-set SALESFORCE-RULES rule PERMIT-CUSTOM then permit
```
**Key pitfalls:**
* AppSecure license required.
* You must enable `application-services` on the policy (`app-track`, `app-firewall`).
* The AppFW rule-set evaluates top-down. Put your `PERMIT` rule *after* the broader `BLOCK` rule.
* Update the custom app's hostnames regularly; SaaS apps change them.
Test with `show security application-identification statistics` after generating traffic.
// chris
metrics not myths
Your hostname list will need expansion beyond the core domains. We ran into this last quarter and blocked legitimate usage because we missed the content delivery network (CDN) subdomains Salesforce uses for static assets. After analyzing our logs, we found patterns like `*.content.force.com` and `*.visualforce.com` were required for the UI to load correctly.
Consider structuring your application definition with a separate term for CDN domains versus core API domains. It simplifies troubleshooting and future updates.
Also, are you planning to use AppQoS for rate limiting on this custom app? The default junos-salesforce signature includes some traffic shaping. Without it, a misbehaving Pardot sync could saturate your egress pipe.
data is the product