A company has an ArubaOS solution. The company wants to prevent users assigned to the "user_group1" role from using gaming and peer-to-peer applications. What is the recommended approach for these requirements?

The recommended and most effective approach is to use Aruba's built-in Deep Packet Inspection (DPI) engine, also known as Application Recognition and Control (ARC). After ensuring DPI is enabled globally, you can create firewall policy rules for the "usergroup1" role that specifically reference the "gaming" and "peer-to-peer" application categories and set the action to "deny". This method is highly accurate as it inspects traffic signatures, not just IP addresses or port numbers, which are often dynamic or obfuscated in modern applications.

B. Application Layer Gateways (ALGs) are for specific protocols that need NAT traversal (e.g., FTP, SIP), not for blocking broad application categories like gaming.
C. Blocking by IP address is unreliable and difficult to maintain, as application servers often use dynamic IPs or content delivery networks (CDNs).
D. Blocking by TCP/UDP port numbers is ineffective because many modern applications can use non-standard ports or tunnel their traffic over common ports like 80/443.

1. ArubaOS 8.10.0.0 User Guide, page 598, "Application and Web Content Classification". The guide states, "The Aruba firewall has the ability to identify, classify, and control network traffic based on applications and web content... You can create firewall policies for user roles to control network access based on applications or application categories."

2. ArubaOS 8.10.0.0 User Guide, page 600, "Configuring a Firewall Policy to Identify Application Traffic". This section details the steps to create a rule, select "App Category" as the match type, and choose categories like "peer-to-peer" or "gaming".