Skype for Business vs Skype

Dmitry_Dmitry — Mon, 12 Nov 2018 22:08:36 GMT

Hi All,

is there a way for Palo to distinguish between Skype and Skype for business?

Application list only suggests you single Skype application...

Idea is to block regular skype and only allow skype for biz, maybe there are any weird workarounds.... like allowing/blocking certain miscorsoft URLs or tcp ports.

Cheers,

Re: Skype for Business vs Skype

BPry — Tue, 13 Nov 2018 04:32:09 GMT

@Dmitry_Dmitry,

Generally I would expect to see the following application for Skype for Business:

ms-lync-base

ms-lync-online

rtcp

stun

rtp

ms-office3650base

ssl

web-browsing

ms-lync-audio

ms-lync-video

A large number of those applications you'll note are still identified as Lync instead of SfB specific App-IDs. You'll also want to exclude *.online.lync.com and *.infra.lync.com from decryption if you have this feature enabled.

Skype you would expect to see the following:

office365-consumer-access

rtcp

rtp

skype

skype-probe

ssl

websocket

stun

web-browsing

windows-azue-base

apple-push-notications (yup, it's a known miss-id)

So to effectively block Just skype I would only block the app-id 'skype', however you can play around with this information as much as you wish obviously and choose what works for you.

topic Skype for Business vs Skype in General Topics

Skype for Business vs Skype

Re: Skype for Business vs Skype