topic Re: Block skype partially work in General Topics

Block skype partially work

helenio.sartori — Tue, 07 Feb 2012 07:41:31 GMT

Hello,

I have panos 3.1.10 and I have rule to block skype and skype-probe application.

I'm using skype client 5.6.59.110 and the behavior is the following:

- skype client authenticate and goes online

- contact became green (online status)

- Calls doesn't work (no ringing tone)

- chat seams work but whit a lot of delay (i.e when you send a message the contact receive it hours later)

Does this behavior lokk correct against application block rule above ?

From my point of view it looks strange that we can login and send chat messages.

Any suggestion ?

Re: Block skype partially work

mikand — Tue, 07 Feb 2012 08:38:50 GMT

Whats the output from the logs of your PAN unit when you does this?

Is the login perhaps identified as web-browsing and since you allow web-browsing this will be allowed to pass?

Also which appid database version do you currently use?

Re: Block skype partially work

gafrol — Tue, 07 Feb 2012 09:00:59 GMT

In order to block skype you should allow skype-probing and block skype.

https://live.paloaltonetworks.com/docs/DOC-1505

rgds Roland

Re: Block skype partially work

helenio.sartori — Wed, 08 Feb 2012 10:29:10 GMT

thank's .. allowing skype-probe even chat services is blocked thank's.

Anyway the Authentication work and Client looks like is online.

Is that the expected behavior of blocking skype application ?

Re: Block skype partially work

gafrol — Wed, 08 Feb 2012 10:47:43 GMT

I just double checked. Skype does not even connect in my setup in the Lab. Did you try to stop and start the skype application ?

Re: Block skype partially work

helenio.sartori — Wed, 08 Feb 2012 15:15:29 GMT

yes, I did.

Re: Block skype partially work

gafrol — Wed, 08 Feb 2012 15:23:20 GMT

Is there other skype users in your LAN ? How does your Security Policy regarding Skype look like ?

http://en.wikipedia.org/wiki/Skype_protocol

Remember you cannot block skype for only part of your users in the same IP subnet. Either you block skype for all users in a given IP subnet or you will loose the game. If you allow one user to use skype, this users skype can become a Supernode which allows other skype users in the same subnet to proxy connections through it.

That might be the case ?