topic Re: Skype & unknown traffic in General Topics

Skype & unknown traffic

sitecore — Thu, 07 Jun 2012 15:48:59 GMT

Hello PAN,

It seems to me that in order to have skype working correctly - particually with multi-site PA's with Site2Site VPN tunnels in between - it is nessesarely to enable both unknown-tcp & unknown-udp.

At least - all our connection problems / delivery delays seems to go away whit the above allowed.

But obviously - allowing "unknown" traffic thru your firewall is not the most obvious solution......

A more soft solution could be if it's possible to define a private application/service where:

if client is connected to skype with src.port = x
then
allow unknown-tcp and unknown-udp where src.port = x

Does anyone know if this is possible somehow

Thanks

Jørgen

Re: Skype & unknown traffic

sspringer — Thu, 07 Jun 2012 17:51:35 GMT

Hello Jørgen,

There is not currently a way to apply a security policy based on source port.

Please ensure you are running the latest application and content release as we are continually modifying the applications. In our latest release(311) the skype-probe application has been modified so updating may resolve your issue.

If you continue to see skype identified as unknown-udp and unknown-tcp on the latest release, please gather packet captures of the traffic and open a support case so we may address the problem in a future application and content release.

- Stefan

Re: Skype & unknown traffic

keitmi01 — Fri, 08 Jun 2012 23:26:06 GMT

Stefan,

I just confirmed that we are on 311-1412 and we're experiencing the same problem. I have some logs and a pcap that I'll open a case with. Although in my traffic analysis I noted that the unknown-tcp source ports did vary from the allowed skype and skype-probe packets. Specifically this is causing an interruption and non-delivery of chat messages in our case. The chat message time stamp will be replaced by "pending" when this occurs.