topic Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube. in Next-Generation Firewall Discussions

URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

AbdulGafoorPP — Tue, 18 Jul 2023 08:48:44 GMT

Palo Alto URL Filtering allows blocked URL categories if one keep refreshing the page. The issue is particularly seen with Youtube.com. We have blocked Streaming Media category and Custom URL to block youtube.com. However the web page is opened after multiple refresh. URL Filtering monitoring logs shows traffic is blocked .However we can access the web page..

PANOS version is 9.1.14

Appreciate if any one can try this behavior to see how it is working in different environment or provide any root cause for this...

Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

akuzhuppilly — Wed, 19 Jul 2023 09:10:00 GMT

Hello @AbdulGafoorPP

You may consider the logic explained in the below KB to block youtube traffic:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGzCAK

Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

Adrian_Jensen — Thu, 20 Jul 2023 19:00:28 GMT

Are you full SSL decryption to all your traffic or just relying on SNI for URL identification? Also, are you blocking "youtube.com/" and "*.youtube.com/" or are you blocking all of Youtube's many variations (i.e. youtu.be, video.google.com, googlevideo.com, etc.)

Because some sites use SSL certificates for multiple FQDN names hosted on the same IPs, I have seen cases where the browser reuses an existing SSL connection for a different FQDN to the same server. So, for example, if you have blocked youtube.com by URL but ytstats.google.com is allowed via other general access rules, you might have an initial SSL connection to ytstats.google.com that is allowed (and you see the SNI "ytstats.google.com"). But then the browser reuses that same SSL connection to call the youtube.com content. If you are not decrypting the SSL then you can not see this reuse for an existing SSL session for a different resource.

Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

ozheng — Fri, 21 Jul 2023 03:02:54 GMT

Hello Abdul,

As Adrian pointed out, to fully guarantee a behavior, SSL decryption will be required.
Without it, it will be best effort (for all traffic relying on SSL).

Olivier

Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

AbdulGafoorPP — Sat, 12 Aug 2023 16:03:32 GMT

Thank you...But we do Full SSL Decryption with an exception for 'play.google.com'. and the environment currently use PAN OS 9.1. 14.. I have read that 9.X version has some limitation to decrypt TLSv1.3 ..Will that be a reason too?

Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

AbdulGafoorPP — Sat, 12 Aug 2023 16:35:26 GMT

TAC Response:

"offline" version of youtube is stored on the web browser!!! Due to which, PA gateway allows this communication...Will that be a reason?

Also, I have noticed that when I set no decryption for 'play.google.com', gateway exclude *.google.com from decryption......

Re: URL Filtering Category level (Streaming Media ) Blocking or Custom Blocking is not working for Youtube.

ozheng — Mon, 14 Aug 2023 04:16:39 GMT

Hello AbdulGafoorPP,

I will not comment on TAC response.

If you have SSL decryption, you can make sure that all the URLs required for youtube to be blocked (a google search "block youtube URLs" will give you a list).

Olivier