topic Re: Youtube streaming not blocking in General Topics

Youtube streaming not blocking

Rahimbhamani — Mon, 06 Mar 2017 08:21:17 GMT

We want to block youtube streaming via Palo Alto. We create the Custom URL Category "testing" and enter the site "*.youtube.com" (with quotation). We select the testing category in Decrpytion profile and Action "Decrpyt" and Type SSL Forwarding. We create the security policy src:any, destination:any and deny youtube-base. But still we can we view streaming on chrome and firefox. We dont have URL Filtering license.

Re: Youtube streaming not blocking

reaper — Mon, 06 Mar 2017 10:41:00 GMT

you don't need to use quotes in custom URL categories, simply set

*.youtube.com

*.youtube.com/*

https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/objects/objects-security-profiles-url-filtering

Re: Youtube streaming not blocking

reaper — Mon, 06 Mar 2017 10:48:23 GMT

hold on

you mention that in your security policy you set youtube-base but you do not mention you added a url-filtering profile

can you confirm you created a url filtering security profile and added it to your security policy ?

does your policy look like this?

it might be better if you split up your policy to have a block rule for youtube-base and then a web-browsing policy that blocks your custom url profile, in case

Re: Youtube streaming not blocking

Brandon_Wertz — Mon, 06 Mar 2017 13:30:26 GMT

Reaper, if they don't have a URL filtering license will applying a URL profile even work?

Re: Youtube streaming not blocking

kiwi — Mon, 06 Mar 2017 13:37:30 GMT

Hi,

It will on custom URL categories.

Cheers,

-Kiwi

Re: Youtube streaming not blocking

bradk14 — Mon, 06 Mar 2017 15:55:32 GMT

if I'm not mistaken, if you already have a URL database (say, had a subscription but let it lapse), you can still process rules against it, you just won't get updates.

not applicable here, but just pointing out I believe the only thing the URL license does for you is updates.

Re: Youtube streaming not blocking

TranceforLife — Mon, 06 Mar 2017 16:30:37 GMT

Good point! Also looking for the confirmation on this :-0

Re: Youtube streaming not blocking

BenjAudy.MTL — Mon, 06 Mar 2017 20:50:48 GMT

It will work, but you will get a warning for each rule using the the URL profile every time you commit. It gets annoying pretty fast.

Benjamin

Re: Youtube streaming not blocking

bradk14 — Mon, 06 Mar 2017 22:36:35 GMT

what's a warning? I hardly ever read failure messages.

Re: Youtube streaming not blocking

reaper — Tue, 07 Mar 2017 08:16:41 GMT

@bradk14 wrote:

if I'm not mistaken, if you already have a URL database (say, had a subscription but let it lapse), you can still process rules against it, you just won't get updates.

not applicable here, but just pointing out I believe the only thing the URL license does for you is updates.

depends slightly on which database you're using:

brightcloud has a downloaded database with the top 2mil most popular websites. once the license expires that list will remain usable but there will be no updates, so miscategorization because a site changes its behavior will start stacking up. once the license is expired dynamic cloud lookups will also stop working

PAN-DB builds a cache from cloud lookups. once the license expires cloud lookups will no longer work and your cache will quickly deprecate

for custom URL categories you don't need a license

Re: Youtube streaming not blocking

BPry — Tue, 07 Mar 2017 13:53:36 GMT

@bradk14

You missed the /s right...right!?

I've had co-workers in the past that won't read error messages and will make me jump on the system to figure out why it's 'just not working', even when the error message is telling them exactly why. Makes my eye twitch reading something like that 😉

Re: Youtube streaming not blocking

reaper — Tue, 07 Mar 2017 14:24:24 GMT

@BPry I was trying real hard to ignore that one comment 😛 *twitch*

Re: Youtube streaming not blocking

bradk14 — Tue, 07 Mar 2017 14:38:12 GMT

@reaperthanks for clarification on the databas

@BPryhalf truth on my part. I know where you're coming from, that's called job security for me. nobody reads error messages or how to use google if they do. but truth is that in my environment, there's never a commit without warnings (of course if you don't address them, they won't go away), so that I have warning fatigue. On the rare occassion there's a failure, it usually takes me 2 or 3 commits to even notice. but when I do notice them, I do read them. promise.