topic Re: Creating Youtube App Filter in General Topics

Creating Youtube App Filter

rodrigum — Thu, 26 Aug 2010 15:25:57 GMT

I have a need to block Youtube via application filter like it used to be before the update to the application filter that allows the front page to be viable, but not any of the videos. I used the custom filter document and was able to get most of the page to not display, however Youtube pulls style sheets from another URL, ytimg.com, since this isn't really a request header how would I write a custom application filter to block all of the page? Has anyone already done this?

Thanks.

Re: Creating Youtube App Filter

blacksan — Thu, 26 Aug 2010 15:28:28 GMT

why not use a URL Filter with youtube.com?

Re: Creating Youtube App Filter

mharding — Thu, 26 Aug 2010 15:29:43 GMT

You could create a custom app that looks for this RegEx in the http-req-header:

.*(ytimg.com)

A URL filter might be a better choice, but there are mulitple ways to accomplish the same task.

Re: Creating Youtube App Filter

rodrigum — Thu, 26 Aug 2010 15:31:46 GMT

I will try the regex option, I don't want to manage any more URL profiles then I have to, I am not on 3.1. Application filtering is a better option for my configuration.

Re: Creating Youtube App Filter

rodrigum — Thu, 26 Aug 2010 16:11:14 GMT

Well here is what I created, but the style sheet still attempts to load.

Re: Creating Youtube App Filter

mharding — Thu, 26 Aug 2010 18:08:14 GMT

Here's what I saw in the PCAP:

GET /yt/cssbin/www-core-vfl186161.css HTTP/1.1
Accept: */*
Referer: http://www.youtube.com/
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)
Accept-Encoding: gzip, deflate
Host: s.ytimg.com
Connection: Keep-Alive

So our problem is that using the RegEx expression .*(Host:).*(s.ytimg.com) is not seven bytes. The RegEx expression must be seven bytes in order to be accecepted by PAN OS.

You may have to use a URL filtering profile here to block the domain ytimg.com.

Re: Creating Youtube App Filter

rodrigum — Thu, 26 Aug 2010 18:11:41 GMT

That is what I am trying to get away from, I am curious how Palo Alto used the filter before they updated it to do what I am trying to do.

Re: Creating Youtube App Filter

mharding — Thu, 26 Aug 2010 18:14:35 GMT

This should explain everything:

YouTube Video Control