topic Re: Blocking bittorrent traffic in General Topics

Blocking bittorrent traffic

MarioG — Tue, 13 Jul 2010 07:55:22 GMT

Hi,

I have just found the time to start learning about our new firewall. As a test I have tried creating a policy for blocking bittorrent traffic, but it seems to have only limited effect. Transmission still happily downloads the torrent although I can see from the logs in the firewall that at least some of the traffic is being denied.

Am I doing something wrong or is the application id simply not capable of correctly identifying all bittorrent traffic?

Regards

mario;

Re: Blocking bittorrent traffic

mharding — Tue, 13 Jul 2010 18:17:34 GMT

What does your security policy look like?

Re: Blocking bittorrent traffic

MarioG — Wed, 14 Jul 2010 06:32:43 GMT

Thanks for answering.

Basically my rule is just: 'from any to any', deny application bittorrent.

I can't see what I could possibly have done wrong 🙂

Best regards

mario;

Re: Blocking bittorrent traffic

mharding — Wed, 14 Jul 2010 13:06:28 GMT

You should have gotten a dependency error when committing. I believe bittorrent also needs web-browsing and ssl.

I bet some of the traffic is being classified as different apps in the logs. I would build an application filter using:

general-internet > file-sharing > peer-to-peer > 5

That should cover all of the various bittorrent apps like ares, kazaa, and even generic-p2p apps. Plus, if Palo Alto ever adds another bittorrent app in their app/content releases, the app will automatically be added to your policy.

Re: Blocking bittorrent traffic

MarioG — Thu, 15 Jul 2010 07:44:41 GMT

I tried your suggestion on building the application filter, but unfortunately the result is much the same. It still can't identify all the bittorrent traffic. I think the traffic that is missed is classified as 'unknown-tcp' and 'incomplete'.

I still don't get any dependancy errors when committing the filters. Should I?

Re: Blocking bittorrent traffic

mharding — Thu, 15 Jul 2010 13:39:13 GMT

Now we are getting somewhere. If you are seeing insufficient-data in the log, that means the firewall did not collect enough packets to determine what the application was. For unknown-tcp, you might want to take a packet capture and submit that to Palo Alto Support. Maybe they need to adjust the decoder for bittorrent traffic.

You may or may not get a dependancy error. I haven't created a bittorrent policy since PAN OS 3.0.

Re: Blocking bittorrent traffic

mjacobsen — Fri, 23 Jul 2010 17:37:25 GMT

Another factor that could be clouding the issue is that if you have started a download prior to the device or blocking policy being inline, the client will have the ability to use that existing info to connect out to those peers. Particularly with encryption enabled on the client, this will make it very difficult to block. You should have success in blocking as long as we are in place with a blocking rule at the time the initial download occurs.