topic Re: Application recognition "ms-teams-audio-video" in General Topics

Application recognition "ms-teams-audio-video"

PatrickPater — Fri, 23 Sep 2022 10:28:51 GMT

Hello,

I run into behavior that I can't explain.
We make teams available on the virtual desktops (web-based & desktop app)
We only want to block the use of audio and video within the functionality of both teams options.
Users are not allowed to use this (due to performance reasons)

In our situation we have configured ssl/tls decryption.
One policy has been defined that blocks the ms-teams-audio-video application.
All other ms-teams* applications are allowed.

However, this ensures that audio and video can be used in both options, the desktop app and web-based.

In the logging I see that the traffic is recognized as ms-teams and I don't see any ms-teams-audio-video.
I expected that as soon as I use audio and video in teams the Palo would recognize this as ms-teams-audio-video

Am I misunderstanding things and is this normal behavior? Or does the application recognition not work properly?

software-version 10.1.6-h3
apps & threats: 8261-7584

With kind regards,
Patrick Pater

Re: Application recognition "ms-teams-audio-video"

BPry — Fri, 23 Sep 2022 14:01:54 GMT

@PatrickPater,

I can verify that I can replicate this behaviour, but I'm actually wondering if its not related to default decryption exclusions that are in place for several Microsoft domains due to certificate pinning?

Re: Application recognition "ms-teams-audio-video"

PatrickPater — Mon, 26 Sep 2022 08:10:42 GMT

@BPry
I'm not sure if it's related to certificate pinning. We tested this earlier in May 2022 on a few machines (proof-of-concept) and then the tests were successful.

If it is related to certificate pinning what is the key function of the application ms-teams-audio-video?

Re: Application recognition "ms-teams-audio-video"

Daniel_Gill — Fri, 12 Apr 2024 23:06:36 GMT

tested with ssl decrypt enabled and works great. blocks the call completely but not any of the other features. this will be good for some client terminal servers. now if i could do the same with Zoom and GoTo.