topic Re: Block YouTube--Allow Google.com in General Topics

Block YouTube--Allow Google.com

kuntzelectroplating — Tue, 22 Nov 2016 14:35:59 GMT

We have 1 user who is abusing Youtube. I need to block this person from YouTube but still allow this person access to google.com

I tried a URL filtering policy but it also blocked access to google.com.

Is there a document or a video of how to perform this task?

I am running PAN OS 7.1

Thank you

Re: Block YouTube--Allow Google.com

Brandon_Wertz — Tue, 22 Nov 2016 15:03:44 GMT

Why not just use application controls?

I'm gonna venture a guess that trying to accomplish this via URLs is going to be an untenable solution.

Re: Block YouTube--Allow Google.com

BPry — Tue, 22 Nov 2016 15:23:48 GMT

How did you block it in the URL filtering?

If you make a custom URL Filtering for this user and list *.youtube.com and youtube.com in the block-list and set the action to block then you should be perfectly fine by just listing the URLs and it shouldn't block Google. You would just need to make a special rule for your special user.

Really though this is trully an issue for your HR department; sometimes companies try to solve HR issues with Tech and it never works out.

Re: Block YouTube--Allow Google.com

kuntzelectroplating — Tue, 22 Nov 2016 15:52:57 GMT

Thank you for your reply.

I first tried to use an application-id, but I was still able to access youtube.com.

Then I tried a URL filter with the domain names you suggested. It blocked youtube but also google.

Google and youtube are so closely tied together now, it is hard to separate them. It looks like (from the logs) that when you go to youtube you are redirected to googlevideo.com.

I couldn't agrre more about the HR issue.

Re: Block YouTube--Allow Google.com

Brandon_Wertz — Tue, 22 Nov 2016 16:15:06 GMT

@kuntzelectroplating

I tried just using the "container" YouTube and was able to access it as well. Then I created a rule that used all the sub-applications and I was denied from viewing the actual videos. This should suffice for your policy request.

I'm running 5060s on 7.0.X with SSL Interception.

--EDIT--

I just created a simple rule that targeted my user ID only to anything out on the Internet using the 4 "YouTube" applications. On application default settings with a "Deny" action and achieved the result below.

Application version

638-3696 (11/21/16)

Re: Block YouTube--Allow Google.com

kuntzelectroplating — Tue, 22 Nov 2016 16:16:53 GMT

Did you deploy a security rule using application-id's or URL filtering?

Re: Block YouTube--Allow Google.com

Brandon_Wertz — Tue, 22 Nov 2016 16:18:32 GMT

0 URL filtering controls. (I've since deleted the rule from my environment so I can't show you.)

Re: Block YouTube--Allow Google.com

Brandon_Wertz — Tue, 22 Nov 2016 16:22:27 GMT

Re: Block YouTube--Allow Google.com

kuntzelectroplating — Tue, 22 Nov 2016 16:49:13 GMT

Thanks...I will give that a try.