topic Re: youtube detection failure in General Topics

youtube detection failure

Ahmed.Eissa — Thu, 20 Feb 2014 13:25:21 GMT

creating security policy to allow specif users to use applications web-browsing and SSL with destination any with using SSL decryption policy which decrypt all.

after this policy there is implicit deny .

the issue that palo alto cant` detect youtube application , monitoring shows that is web-browsing is permitted and falsh is denied !!!!

how i can block youtube appliaction ?

Re: youtube detection failure

HULK — Thu, 20 Feb 2014 16:50:25 GMT

Hello Sir,

Could you please provide below mentioned information:

PA Platform-

PAN-OS-

Apps & Threat version-

I will verify the same and let you know the result.

Thanks

Re: youtube detection failure

kdd — Fri, 21 Feb 2014 08:19:43 GMT

Hi Ahmed,

before the web-browsing rule i would insert this rule.

PA detects youtube-base etc. Is this what works for you?

Cheers Klaus

Re: youtube detection failure

HULK — Fri, 21 Feb 2014 09:00:28 GMT

Hello Klaus,

You are absolutely correct. Without having SSL decryption, we can simply add the YouTube application in a security policy and it will successfully block YouTube video. ( Users will be able to open www.youtube.com, but they will not be able to run any video).

To Ahmed,

If you want to block all types of activity through www.youtube.com i.e. YouTube-posting, safe-mode, uploading, then you can use application= YouTube ( patent application) as mentioned below:

Reference doc: YouTube Video Control

How to Allow a Single YouTube Video and Block All Other Videos

Create a Custom Application for a YouTube Channel

Logs:

Hope this helps.

Thanks

Re: youtube detection failure

Ahmed.Eissa — Sun, 23 Feb 2014 11:59:33 GMT

version 5.0.11

PA 3050

Threats 420-2111

apps 1217-1682

thanks for your support

Re: youtube detection failure

Ahmed.Eissa — Sun, 23 Feb 2014 13:11:32 GMT

i did create a deny rule to deny youtube but it didn`t work ,...

.the main issue that the device is not detecting Youtube-saftey application , the only application is detected is youtube-base.

as shown below only flash is detected ,, note that destination ip is related to google .. really i cant understand why ???

this can identify youtube with a destination ip ( google !!!!)...

Re: youtube detection failure

Lahcen — Thu, 03 Apr 2014 14:37:31 GMT

Hi Ahmed,

did you solve this problem i have the same issue i'm using PA-500 in virtual mode.

Best Regards

Re: youtube detection failure

Ahmed.Eissa — Tue, 08 Apr 2014 12:32:41 GMT

nope it is still exist , i contacted palo alto support and have in progress ticket with them , i`ll inform you with updates

Re: youtube detection failure

Lahcen — Tue, 08 Apr 2014 13:28:15 GMT

Thank you Ahmed,

I'll be waiting for your reply.

Re: youtube detection failure

dyang — Tue, 08 Apr 2014 21:36:12 GMT

Hi Ahmed,

Google made a change a few months ago to the way they implement YouTube Safety Mode, which affects our ability to accurately identify this traffic with our youtube-safety-mode App-ID signature. As such, the App-ID for YouTube Safety Mode will likely not show up anymore. If you would like to enforce YouTube Safety Mode, you can do this via a URL filtering feature, "SafeSearch Enforcement". When enabled, any Google, Yahoo or Bing web searches will be checked to make sure that the strictest Safe Search setting is enabled, and this applies to YouTube Safety Mode as well. If the settings are correct, the search is allowed. Otherwise, a block page is displayed, with instructions on how to correctly fix their settings. Once this has been done, all subsequent searches will go through. In order to ensure that YouTube Safety Mode is covered, please be sure to install content version 422 or later.

Thanks,

Doris