topic Re: Skype manager custom application in General Topics

Skype manager custom application

helenio.sartori — Thu, 23 Oct 2014 07:29:18 GMT

Hello,

I'm actually blocking skype application but I would like to allow skype manager web site (https://manager.skype.com/).

The web site manager.skype.com is blocked because recognized as skype application.

The idea is to build a application that allow skype with hostname https://manager.skype.com/

The custom app I created is here below but it doesn't work, any idea why ? where I'm wrong ?

Re: Skype manager custom application

hshah — Thu, 23 Oct 2014 09:51:16 GMT

Hi Helenio,

Easier thing would be to create one policy on the top of skype block, and while list manager.skype.com. Let me know if that helps.

Please refer following URL Profile for the same.

Regards,

Hardik Shah

Re: Skype manager custom application

HULK — Thu, 23 Oct 2014 10:41:40 GMT

Hi Helenio,

The best way to achiaive the goal through URL filtering profiles, instead of creating a custom application signature. Since this is an HTTPS connection. SSL traffic will be encrypted and the PAN firewall will not be able to identify the actual URL, instead it will categorize traffic ( URL) based on it's certificate common name. For the mentioned URL :https://manager.skype.com/ the certificate common name is "login.skype.com".

I have tested below the mentioned filtering profile on my PAN firewall and it seems to be working fine. ( you may fine tuned it)

A related doc for your reference: Controlling Skype

Hope this helps.

Thanks

Re: Skype manager custom application

hyadavalli — Fri, 24 Oct 2014 00:02:59 GMT

Hello,

Please try below suggestion for custom application to allow manager skype

Re: Skype manager custom application

hshah — Fri, 24 Oct 2014 00:33:53 GMT

Hi Helenio,

I tried in lab, it seems manager.skype.paloaltonetworks.com depends on url apps.skypeassets.com.

Its not just one URL, its calling info from other URL. May be thats creating problem.

Regards,

Hardik Shah

Re: Skype manager custom application

helenio.sartori — Fri, 24 Oct 2014 06:10:22 GMT

I can't work with URL profiles because I have a top rule with application skype blocked and rule with URL profile are below this rule.

I have to bypass skype application detection before the rule that block skype application therefore I have to bypass the skype application detection with a rule on top of it with a matching and not a policy.

The only way in may case is custom application. I tried suggestion from hyadavalli but i didn't manage to work.

There is some detailed guide how to build custom application ?

Re: Skype manager custom application

HULK — Fri, 24 Oct 2014 06:18:20 GMT

Below mentioned document will help you to build custom application signature: Custom Application Signatures

Hope this helps.

Thanks

Re: Skype manager custom application

kfindlen — Fri, 24 Oct 2014 07:45:41 GMT

Using a custom signature to override the application identification performed by the firewall is limited to when the traffic is identified as only a base application which has a decoder.

Some examples of base applications with decoders:

web-browsing (http context)

ssl

ftp

dns

smtp

.. and others..

You can find the decoder list current as of content 424 in the Custom Application Signaturesdocument on page 7.

What this means in practice is that a session which is identified as one of the apps listed above can utilize custom signatures to further identify the traffic. In your case, once the firewall identifies the application as skype there is no decoder being utilized on the session, so custom signatures would not be applied. The custom signature can not override the built-in signatures for other applications which only have a dependency on one of these base apps (skype has a dependency on ssl).

Like others have mentioned, I believe your only option is to utilize URL filtering to not apply the skype block when the URL matches "manager.skype.com", or explicitly allow any traffic to that URL.